CVE-2026-98860: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-18 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -EPIPE, ret is implicitly promoted to size_t when compared against size. This causes the negative error code to evaluate as a large positive number, making the (ret > size) condition true. This silently converts the hardware error into a success return value and copies the unmodified buffer back, which could leave BPF programs operating on uninitialized or stale data. Fix this by casting size into ssize_t to return the actual negative error code.

Affected products

Linux kernel: from 6.12.78 before 6.12.113; from 6.18.20 before 6.18.56; from 6.19.10 before 6.20; 7.0 — fixed in 6.12.113, 6.18.56, 6.20, 7.3

How to fix

Upgrade to a fixed version: Linux kernel 6.12.113, 6.18.56, 6.20, 7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-98860 or the next vulnerability affects your stack