{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98860", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.376Z", "datePublished": "2026-10-18T15:51:21.403Z", "dateUpdated": "2026-10-19T09:26:54.770Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:26:54.770Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bpf: cast size to ssize_t when checking hid_bpf_hw_request\n\nAs reported by Sashiko:\nIf a transport driver encounters a hardware error and returns a negative\nerror code such as -EPIPE, ret is implicitly promoted to size_t when\ncompared against size. This causes the negative error code to evaluate\nas a large positive number, making the (ret > size) condition true.\n\nThis silently converts the hardware error into a success return value\nand copies the unmodified buffer back, which could leave BPF programs\noperating on uninitialized or stale data.\n\nFix this by casting size into ssize_t to return the actual negative\nerror code."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hid/bpf/hid_bpf_dispatch.c"], "versions": [{"version": "d6efaa50af62fb0790dd1fd4e7e5506b46312510", "lessThan": "8b85ef0f561039e249c3f883c5280a1449c6dbee", "status": "affected", "versionType": "git"}, {"version": "73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1", "lessThan": "97be6396817bd3b11d06239010d27902940bfaa9", "status": "affected", "versionType": "git"}, {"version": "2b658c1c442ec1cd9eec5ead98d68662c40fe645", "lessThan": "f9f808227554b2c116fd07dd2328ecd74ea3f411", "status": "affected", "versionType": "git"}, {"version": "2b658c1c442ec1cd9eec5ead98d68662c40fe645", "lessThan": "3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c", "status": "affected", "versionType": "git"}, {"version": "eb57dae20fdf6f3069cdc07821fa3bb46de381d7", "status": "affected", "versionType": "git"}, {"version": "6.12.78", "lessThan": "6.12.113", "status": "affected", "versionType": "semver"}, {"version": "6.18.20", "lessThan": "6.18.56", "status": "affected", "versionType": "semver"}, {"version": "6.19.10", "lessThan": "6.20", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hid/bpf/hid_bpf_dispatch.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.78", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.20", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8b85ef0f561039e249c3f883c5280a1449c6dbee"}, {"url": "https://git.kernel.org/stable/c/97be6396817bd3b11d06239010d27902940bfaa9"}, {"url": "https://git.kernel.org/stable/c/f9f808227554b2c116fd07dd2328ecd74ea3f411"}, {"url": "https://git.kernel.org/stable/c/3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c"}], "title": "HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/hid/bpf/hid_bpf_dispatch.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8b85ef0f561039e249c3f883c5280a1449c6dbee", "status": "affected", "version": "d6efaa50af62fb0790dd1fd4e7e5506b46312510", "versionType": "git"}, {"lessThan": "97be6396817bd3b11d06239010d27902940bfaa9", "status": "affected", "version": "73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1", "versionType": "git"}, {"lessThan": "f9f808227554b2c116fd07dd2328ecd74ea3f411", "status": "affected", "version": "2b658c1c442ec1cd9eec5ead98d68662c40fe645", "versionType": "git"}, {"lessThan": "3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c", "status": "affected", "version": "2b658c1c442ec1cd9eec5ead98d68662c40fe645", "versionType": "git"}, {"status": "affected", "version": "eb57dae20fdf6f3069cdc07821fa3bb46de381d7", "versionType": "git"}, {"lessThan": "6.12.113", "status": "affected", "version": "6.12.78", "versionType": "semver"}, {"lessThan": "6.18.56", "status": "affected", "version": "6.18.20", "versionType": "semver"}, {"lessThan": "6.20", "status": "affected", "version": "6.19.10", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/hid/bpf/hid_bpf_dispatch.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bpf: cast size to ssize_t when checking hid_bpf_hw_request\n\nAs reported by Sashiko:\nIf a transport driver encounters a hardware error and returns a negative\nerror code such as -EPIPE, ret is implicitly promoted to size_t when\ncompared against size. This causes the negative error code to evaluate\nas a large positive number, making the (ret > size) condition true.\n\nThis silently converts the hardware error into a success return value\nand copies the unmodified buffer back, which could leave BPF programs\noperating on uninitialized or stale data.\n\nFix this by casting size into ssize_t to return the actual negative\nerror code."}], "id": "CVE-2026-98860", "lastModified": "2026-10-19T10:19:50.087", "metrics": {}, "published": "2026-10-18T16:17:40.470", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8b85ef0f561039e249c3f883c5280a1449c6dbee"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/97be6396817bd3b11d06239010d27902940bfaa9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f9f808227554b2c116fd07dd2328ecd74ea3f411"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}