Look up another CVE · open CVE-2026-89729 in the interactive tracker
CVE-2026-89729
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem drivers/hid. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-89729 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
sensor_hub_get_feature() clamps its return value to the caller's buffer size, but the copy loop still copies field->report_size / 8 bytes for each report value. A malicious HID descriptor can advertise a large feature field size while an IIO caller supplies a small stack buffer, such as a single s32, causing an out-of-bounds write. HID core stores parsed report values in __s32 slots and clamps extracted values to 32 bits. Reject feature fields that require more than one slot per value, guard the total byte count calculation, and clamp each per-value copy to the remaining caller buffer.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/hid/hid-sensor-hub.c
- What this is
- HID SENSOR HUB DRIVERSMAINTAINERS section matched on drivers/hid/hid-sensor-* · linux-input@vger.kernel.org · Maintained
- Kernel module
- hid_sensor_hub
Check it on the machine
grep -wE 'CONFIG_HID|CONFIG_HID_SENSOR_HUB|CONFIG_HID_SUPPORT' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w hid_sensor_hubPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookworm, trixieMnot built on arm64/cloud-arm64
- forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- bookworm · linux-6.12Mnot built on arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_HID, CONFIG_HID_SENSOR_HUB, CONFIG_HID_SUPPORT
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-11 (37 days ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.36%, higher than 27.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/hid
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.9 | 5.10.270 | 1c0463f0f028 |
| 4.9 | 5.15.221 | 4145aa149a32 |
| 4.9 | 6.1.188 | 8bf8aaf2f74d |
| 4.9 | 6.6.157 | c5c60260a07e |
| 4.9 | 6.12.109 | fa95b14198b6 |
| 4.9 | 6.18.50 | 9f43499ce645 |
| 4.9 | 7.2.4 | bc3d72c44bff |
| 4.9 | 7.3 | c92693f3ed09 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- hid-sensor-hub matches HID_BUS_ANY/HID_GROUP_SENSOR_HUB, so a Bluetooth HID/HoGP peripheral can present a Sensor-page descriptor and drive the bug over an adjacent wireless link; USB is only physical, and Adjacent is the most severe reasonable transport.
- AC:LAttack complexity, low
- The attacker fully controls the report descriptor (report_size up to 256 bits, report_count, power-state feature) and GET_REPORT payload; IIO probe then copies report_size/8 bytes into a 4-byte stack buffer with no race or uncontrolled condition required.
- PR:NPrivileges required, none
- A malicious HID peripheral is sufficient: hid-sensor-hub and IIO clients autoload and call sensor_hub_get_feature() during enumeration, with no local account, capability, or init-namespace privilege on the victim.
- UI:NUser interaction, none
- hid_sensor_parse_common_attributes() calls sensor_hub_get_feature() from IIO probe as soon as the device connects or auto-reconnects and MFD cells are registered; no extra victim open, mount, or confirmation is required.
- S:UScope, unchanged
- The out-of-bounds write corrupts host kernel stack/heap in HID/IIO processing and does not cross a VM, IOMMU, or other separate security authority.
- C:HConfidentiality impact, high
- The unbounded memcpy reads field->value and adjacent kernel memory into an overflowed stack frame, and GET_REPORT values are attacker-controlled; this kernel memory corruption can be leveraged for information disclosure.
- I:HIntegrity impact, high
- This is a kernel stack out-of-bounds write of up to 32 attacker-influenced bytes into IIO callers' 4-byte s32 buffers, enabling control-flow hijacking; out-of-bounds writes are High integrity.
- A:HAvailability impact, high
- Stack or adjacent-memory corruption from the unbounded copy causes a kernel oops/panic (canary, bad control flow, or heap corruption), denying availability until reboot.