The vulnerability in the Linux kernel's intel-thc-hid driver (intel-quickspi) involved the write_cmd_to_txdma() function copying a caller-supplied report into a heap buffer allocated based on a device descriptor's max_report_len without validating that the report size fits. The HID core caps reports at HID_MAX_BUFFER_SIZE (16384 bytes), but the driver did not set max_buffer_size, allowing unbounded length reports to overflow the buffer. The fix records the allocation size and rejects reports that exceed it before copying, aligning with similar protections in related drivers. Buffer allocation was also adjusted to cover the output report header to maintain proper bounds checking.

An attacker could exploit this vulnerability by sending a specially crafted SET_REPORT or SET_FEATURE ioctl with a report larger than the allocated buffer, causing a heap buffer overflow. This could potentially lead to memory corruption, denial of service, or other unintended behavior within the kernel's HID subsystem. No known exploits in the wild have been reported.

This vulnerability has been resolved in the Linux kernel by adding validation of the report size before copying and adjusting buffer allocation to prevent overflow. Users and administrators should apply the official Linux kernel updates that include this fix. Patch status is confirmed as fixed in the kernel; check the vendor or kernel release notes for the specific fixed versions.