CVE-2026-72352 | BDVDB-2026-359805 Detail

Description#

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hid_bpf_get_data() range check hid_bpf_get_data() returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx->allocated_size. The current check adds rdwr_buf_size and offset before comparing the result against ctx->allocated_size. Since both values are unsigned, a very large size can wrap the sum below ctx->allocated_size and make the helper return a pointer even though the requested range is not contained in the backing buffer. Use check_add_overflow() to reject wrapped range ends before comparing the requested range end against ctx->allocated_size.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-15Record published in the CVE List.
2. Version 22026-10-21Most recent update recorded in the CVE List.