Out-of-bounds write in Linux kernel - CVE-2026-80780
Published: September 5, 2026
Vulnerability identifier: #VU147146
CSH Severity: Low
CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80780
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker with physical access to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in hid_pidff_init_with_quirks() when initializing force feedback for a malicious USB HID device with an empty inputs list. An attacker with physical access can connect a malicious USB HID device to cause memory corruption.
The issue is reachable during device probing on the hotplug workqueue.
Affected software
Linux kernel
How to mitigate CVE-2026-80780
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/2e0471bf3ab2a6b7eedcc3b8a2a17286b6a9ae1a
- https://git.kernel.org/stable/c/4529c03c3da8f91392cd630453452f569973f4cd
- https://git.kernel.org/stable/c/67bb1074e3d2d12fa059a9cc707e89398a4e4704
- https://git.kernel.org/stable/c/86b63adfa5e132beac4be72668fdf9128fe51d2e
- https://git.kernel.org/stable/c/ad9330f7e74a97842815a291a0d7389ed2f34504
- https://git.kernel.org/stable/c/d416eeb7d016d82af67c149d884bc6a9323c4ac7