---
id: "CVE-2026-98860"
kind: "vulnerability"
aliases: ["CVE-2026-98860"]
title: "Linux kernel: HID BPF request error silently treated as success"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["hid-bpf", "infrastructure", "linux-kernel"]
not_affected_if: []
published_at: "2026-10-18T16:17:40+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:12:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98860", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Linux kernel: HID BPF request error silently treated as success

In the Linux kernel's HID BPF code, a negative hardware error such as -EPIPE was compared as an unsigned size, so it was reported as success and the unmodified buffer was copied back. BPF programs could then act on stale or uninitialized data instead of seeing the error.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update to a Linux kernel release that includes the upstream commit 'HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request'
- unknown

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98860

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request

As reported by Sashiko:
If a transport driver encounters a hardware error and returns a negative
error code such as -EPIPE, ret is implicitly promoted to size_t when
compared against size. This causes the negative error code to evaluate
as a large positive number, making the (ret > size) condition true.

This silently converts the hardware error into a success return value
and copies the unmodified buffer back, which could leave BPF programs
operating on uninitialized or stale data.

Fix this by casting size into ssize_t to return the actual negative
error code.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_