{"id":"CVE-2026-98860","revision":"285f1e20a6f64576be89f4d1fa4d1428","records":[{"revision":"285f1e20a6f64576be89f4d1fa4d1428","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98860","aliases":[],"title":"HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bpf: cast size to ssize_t when checking hid_bpf_hw_request\n\nAs reported by Sashiko:\nIf a transport driver encounters a hardware error and returns a negative\nerror code such as -EPIPE, ret is implicitly promoted to size_t when\ncompared against size. This causes the negative error code to evaluate\nas a large positive number, making the (ret > size) condition true.\n\nThis silently converts the hardware error into a success return value\nand copies the unmodified buffer back, which could leave BPF programs\noperating on uninitialized or stale data.\n\nFix this by casting size into ssize_t to return the actual negative\nerror code.","state":0,"publishedAt":"2026-10-18T15:51:21.403+00:00","modifiedAt":"2026-10-19T09:26:54.77+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/hid/bpf/hid_bpf_dispatch.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"d6efaa50af62fb0790dd1fd4e7e5506b46312510\",\n                            \"lessThan\": \"8b85ef0f561039e249c3f883c5280a1449c6dbee\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1\",\n                            \"lessThan\": \"97be6396817bd3b11d06239010d27902940bfaa9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2b658c1c442ec1cd9eec5ead98d68662c40fe645\",\n                            \"lessThan\": \"f9f808227554b2c116fd07dd2328ecd74ea3f411\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2b658c1c442ec1cd9eec5ead98d68662c40fe645\",\n                            \"lessThan\": \"3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eb57dae20fdf6f3069cdc07821fa3bb46de381d7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.12.78\",\n                            \"lessThan\": \"6.12.113\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.20\",\n                            \"lessThan\": \"6.18.56\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.10\",\n                            \"lessThan\": \"6.20\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/hid/bpf/hid_bpf_dispatch.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.113\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.56\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.10\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/8b85ef0f561039e249c3f883c5280a1449c6dbee","https://git.kernel.org/stable/c/97be6396817bd3b11d06239010d27902940bfaa9","https://git.kernel.org/stable/c/f9f808227554b2c116fd07dd2328ecd74ea3f411","https://git.kernel.org/stable/c/3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98860","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98860","identifiers":["CVE-2026-98860"]},"retained":false,"historicalAffected":[]}],"coverage":[]}