{"id":"CVE-2026-98860","kind":"vulnerability","aliases":["CVE-2026-98860"],"related":[],"title":"Linux kernel: HID BPF request error silently treated as success","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bpf: cast size to ssize_t when checking hid_bpf_hw_request\n\nAs reported by Sashiko:\nIf a transport driver encounters a hardware error and returns a negative\nerror code such as -EPIPE, ret is implicitly promoted to size_t when\ncompared against size. This causes the negative error code to evaluate\nas a large positive number, making the (ret > size) condition true.\n\nThis silently converts the hardware error into a success return value\nand copies the unmodified buffer back, which could leave BPF programs\noperating on uninitialized or stale data.\n\nFix this by casting size into ssize_t to return the actual negative\nerror code.","summary":"In the Linux kernel's HID BPF code, a negative hardware error such as -EPIPE was compared as an unsigned size, so it was reported as success and the unmodified buffer was copied back. BPF programs could then act on stale or uninitialized data instead of seeing the error.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hid-bpf","infrastructure","linux-kernel"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit 'HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request'\n- unknown","status":"open","published_at":"2026-10-18T16:17:40+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:54+00:00","updated_at":"2026-10-25T05:12:54+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:12:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit 'HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request'\n- unknown","reach":"local","title":"Linux kernel: HID BPF request error silently treated as success","impact":"low","summary":"In the Linux kernel's HID BPF code, a negative hardware error such as -EPIPE was compared as an unsigned size, so it was reported as success and the unmodified buffer was copied back. BPF programs could then act on stale or uninitialized data instead of seeing the error.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","hid-bpf"],"confidence":0.5,"needs_auth":"unknown","worst_case":"BPF programs read stale or uninitialized buffer data after hardware errors","analyst_note":"Find the affected kernel version range and the fixed stable release from the NVD entry or the upstream kernel commit.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel with HID BPF support and BPF programs that call hid_bpf_hw_request on HID devices. The sources do not say which kernel versions are affected or whether systems without HID BPF programs are impacted, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00059,"input_tokens":3444,"output_tokens":492,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98860':13A,16A 'act':62B 'actual':186C 'back':57B,163C 'bpf':4A,19B,30B,58B,84C,93C,167C 'buffer':54B,162C 'cast':85C,178C 'caus':129C 'check':91C 'code':31B,113C,133C,189C 'compar':40B,125C 'condit':145C 'convert':149C 'copi':56B,159C 'could':60B,165C 'cve':11A,14A 'data':67B,174C 'driver':103C 'encount':104C 'epip':38B,116C 'error':6A,35B,72B,107C,112C,132C,152C,188C 'evalu':135C 'fix':175C 'follow':78C 'hardwar':34B,106C,151C 'hid':3A,18B,29B,83C,92C 'hid-bpf':17B 'hw':94C 'implicit':119C 'infrastructur':20B 'instead':68B 'kernel':2A,23B,27B,76C 'larg':138C 'leav':166C 'linux':1A,22B,26B,75C 'linux-kernel':21B 'make':141C 'negat':33B,111C,131C,187C 'number':140C 'oper':169C 'posit':139C 'program':59B,168C 'promot':120C 'report':48B,97C 'request':5A,95C 'resolv':82C 'ret':117C,143C 'return':109C,156C,184C 'sashiko':99C 'see':70B 'silent':7A,148C 'size':44B,86C,122C,127C,144C,179C 'ssize':88C,181C 'stale':64B,173C 'success':10A,50B,155C 'transport':102C 'treat':8A 'true':146C 'uniniti':66B,171C 'unmodifi':53B,161C 'unsign':43B 'valu':157C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with HID BPF support and BPF programs that call hid_bpf_hw_request on HID devices. The sources do not say which kernel versions are affected or whether systems without HID BPF programs are impacted, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98860","severity":null,"published_at":"2026-10-18T16:17:40+00:00","modified_at":"2026-10-19T10:19:50+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}