CVE-2026-89729
High · 8.8CVSS
8.8
EPSS
0.4%
Published
Sep 11, 2026
CISA due date
—
Cloudanix analysis
A bug in the way Linux talks to certain built-in sensors could let a specially crafted device corrupt memory and potentially take over or crash the computer.
- Exploitation
- Adjacent Network
- Attacker needs
- None
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Buffer Overflow
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Out-of-bounds write in the Linux kernel HID sensor-hub driver when sensor_hub_get_feature copies field->report_size/8 bytes per value even after clamping the return value, allowing a malicious HID descriptor to advertise oversized feature fields against a small caller buffer such as a single s32.
Why it matters to the business
Potential kernel memory corruption on Linux systems exposing HID sensor hubs, enabling local or adjacent attackers to achieve code execution or denial of service; low immediate risk given stable low EPSS and absence from KEV or ransomware campaigns.
How an attack unfolds
An attacker supplies a malicious HID descriptor declaring a feature field requiring multiple __s32 slots. The IIO caller invokes sensor_hub_get_feature with a small stack buffer; the copy loop ignores the clamped return value and writes beyond the buffer bounds.
How to fix it
Apply the upstream fix that rejects feature fields needing more than one __s32 slot, guards total byte count, and clamps each per-value copy to the remaining caller buffer; update to a patched Linux kernel version.
How to confirm the fix worked
Inspect kernel source for the added rejection and clamping logic in sensor_hub_get_feature; recompile and test with a synthetic HID descriptor that advertises a multi-slot feature field against a single-s32 buffer.
Typical attack path
- Present a crafted HID descriptor via USB or Bluetooth to a Linux system
- Trigger sensor_hub_get_feature through normal IIO sensor feature report handling
- Cause the oversized per-value copy to perform an out-of-bounds write
How to detect it
Search kernel logs for oops or panic messages referencing sensor_hub_get_feature or HID report parsing; inspect dmesg and audit logs for unexpected HID descriptor sizes or feature report handling errors.
What your security team should do
- Patch Linux kernels on all systems exposing HID sensor hubs within normal maintenance windows given low EPSS and no KEV listing
- Harden HID device allow-listing where feasible on embedded or IoT deployments
- Monitor EPSS trend and new exploit maturity signals before elevating priority
The record
In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature sensor_hub_get_feature() clamps its return value to the caller's buffer size, but the copy loop still copies field->report_size / 8 bytes for each report value. A malicious HID descriptor can advertise a large feature field size while an IIO caller supplies a small stack buffer, such as a single s32, causing an out-of-bounds write. HID core stores parsed report values in __s32 slots and clamps extracted values to 32 bits. Reject feature fields that require more than one slot per value, guard the total byte count calculation, and clamp each per-value copy to the remaining caller buffer.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|