CVE-2026-72352
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel, the HID-BPF module has a vulnerability in hid_bpf_get_data() due to an incorrect range check. Because of unsigned arithmetic, a very large size can wrap the sum and bypass the check, allowing a pointer outside the buffer to be returned.
Risk Assessment
The risk includes potential out-of-bounds read or write, which could lead to memory safety violations or system crashes.
Recommendation
Apply the patch that uses check_add_overflow() to reject wrapped range ends before comparing with ctx->allocated_size.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hid_bpf_get_data() range check hid_bpf_get_data() returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx->allocated_size. The current check adds rdwr_buf_size and offset before comparing the result against ctx->allocated_size. Since both values are unsigned, a very large size can wrap the sum below ctx->allocated_size and make the helper return a pointer even though the requested range is not contained in the backing buffer. Use check_add_overflow() to reject wrapped range ends before comparing the requested range end against ctx->allocated_size.