Live › vulnerability › CVE-2026-98860
Go to dashboardIn the Linux kernel's HID BPF code, a negative hardware error such as -EPIPE was compared as an unsigned size, so it was reported as success and the unmodified buffer was copied back. BPF programs could then act on stale or uninitialized data instead of seeing the error.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with HID BPF support and BPF programs that call hid_bpf_hw_request on HID devices. The sources do not say which kernel versions are affected or whether systems without HID BPF programs are impacted, so unknown.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -EPIPE, ret is implicitly promoted to size_t when compared against size. This causes the negative error code to evaluate as a large positive number, making the (ret > size) condition true.
This silently converts the hardware error into a success return value and copies the unmodified buffer back, which could leave BPF programs operating on uninitialized or stale data.
Fix this by casting size into ssize_t to return the actual negative error code.
This page as .md · .json · in your agent: get_signal("CVE-2026-98860")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.