The Linux kernel's HID sensor-hub had an out-of-bounds write vulnerability in the sensor_hub_get_feature() function. Although the function clamps its return value to the caller's buffer size, the copy loop copies field->report_size / 8 bytes for each report value regardless, leading to potential buffer overflow if a malicious HID descriptor advertises a large feature field size while the caller provides a smaller buffer. The fix involves rejecting feature fields that require more than one slot per value, guarding total byte count calculations, and clamping each per-value copy to the remaining caller buffer size.

This vulnerability could allow a malicious HID device to cause an out-of-bounds write in kernel memory, potentially leading to system instability or escalation of privileges. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this vulnerability by validating feature field sizes and clamping copy operations. Users should apply the official kernel updates containing this fix when available. Patch status is not explicitly stated in the provided data; check the vendor advisory for current remediation guidance.