CVE-2026-31401
published 2026-04-03CVE-2026-31401: In the Linux kernel, the following vulnerability has been resolved: HID: bpf: prevent buffer overflow in hid_hw_request right now the returned value is…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
3.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
HID: bpf: prevent buffer overflow in hid_hw_request
right now the returned value is considered to be always valid. However,
when playing with HID-BPF, the return value can be arbitrary big,
because it's the return value of dispatch_hid_bpf_raw_requests(), which
calls the struct_ops and we have no guarantees that the value makes
sense.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.10-1 (forky) | linux 6.19.10-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 8bd0488b5ea58655ad6fdcbe0408ef49b16882b1 < d6efaa50af62fb0790dd1fd4e7e5506b46312510 | d6efaa50af62fb0790dd1fd4e7e5506b46312510 |
| linux | linux | >= 8bd0488b5ea58655ad6fdcbe0408ef49b16882b1 < 73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1 | 73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1 |
| linux | linux | >= 8bd0488b5ea58655ad6fdcbe0408ef49b16882b1 < eb57dae20fdf6f3069cdc07821fa3bb46de381d7 | eb57dae20fdf6f3069cdc07821fa3bb46de381d7 |
| linux | linux | >= 8bd0488b5ea58655ad6fdcbe0408ef49b16882b1 < 2b658c1c442ec1cd9eec5ead98d68662c40fe645 | 2b658c1c442ec1cd9eec5ead98d68662c40fe645 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.10-1 | 6.19.10-1 |
| linux | linux_kernel | >= 6.11 < 6.12.78 | 6.12.78 |
| linux | linux_kernel | >= 6.13 < 6.18.20 | 6.18.20 |
| linux | linux_kernel | >= 6.19 < 6.19.10 | 6.19.10 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat4.4LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: HID: bpf: prevent buffer overflow in hid_hw_request
vendor_redhat·2026-04-03·CVSS 4.4
CVE-2026-31401 [LOW] CWE-131 kernel: HID: bpf: prevent buffer overflow in hid_hw_request
kernel: HID: bpf: prevent buffer overflow in hid_hw_request
In the Linux kernel, the following vulnerability has been resolved:
HID: bpf: prevent buffer overflow in hid_hw_request
right now the returned value is considered to be always valid. However,
when playing with HID-BPF, the return value can be arbitrary big,
because it's the return value of dispatch_hid_bpf_raw_requests(), which
calls the struct_ops and we have no guarantees that the value makes
sense.
A flaw was found in the Linux kernel's Human Interface Device (HID) BPF (Berkeley Packet Filter) component. This vulnerability occurs in the `hid_hw_request` function, where an uncontrolled return value from `dispatch_hid_bpf_raw_requests()` can lead to a buffer overflow. This could allow a local attacker to cause memory corruption
Debian
CVE-2026-31401: linux - In the Linux kernel, the following vulnerability has been resolved: HID: bpf: p...
vendor_debian·2026
CVE-2026-31401 [LOW] CVE-2026-31401: linux - In the Linux kernel, the following vulnerability has been resolved: HID: bpf: p...
In the Linux kernel, the following vulnerability has been resolved: HID: bpf: prevent buffer overflow in hid_hw_request right now the returned value is considered to be always valid. However, when playing with HID-BPF, the return value can be arbitrary big, because it's the return value of dispatch_hid_bpf_raw_requests(), which calls the struct_ops and we have no guarantees that the value makes sense.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.19.10-1)
sid: resolved (fixed in 6.19.10-1)
trixie: open
OSV
CVE-2026-31401: In the Linux kernel, the following vulnerability has been resolved: HID: bpf: prevent buffer overflow in hid_hw_request right now the returned value i
osv·2026-04-03
CVE-2026-31401 CVE-2026-31401: In the Linux kernel, the following vulnerability has been resolved: HID: bpf: prevent buffer overflow in hid_hw_request right now the returned value i
In the Linux kernel, the following vulnerability has been resolved: HID: bpf: prevent buffer overflow in hid_hw_request right now the returned value is considered to be always valid. However, when playing with HID-BPF, the return value can be arbitrary big, because it's the return value of dispatch_hid_bpf_raw_requests(), which calls the struct_ops and we have no guarantees that the value makes sense.
GHSA
GHSA-whg2-hqg5-6ph3: In the Linux kernel, the following vulnerability has been resolved:
HID: bpf: prevent buffer overflow in hid_hw_request
right now the returned value
ghsa_unreviewed·2026-04-03
CVE-2026-31401 GHSA-whg2-hqg5-6ph3: In the Linux kernel, the following vulnerability has been resolved:
HID: bpf: prevent buffer overflow in hid_hw_request
right now the returned value
In the Linux kernel, the following vulnerability has been resolved:
HID: bpf: prevent buffer overflow in hid_hw_request
right now the returned value is considered to be always valid. However,
when playing with HID-BPF, the return value can be arbitrary big,
because it's the return value of dispatch_hid_bpf_raw_requests(), which
calls the struct_ops and we have no guarantees that the value makes
sense.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-31401 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2026-31401 CVE-2026-31401 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-31401 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
HID: bpf: prevent buffer overflow in hid_hw_request
right now the returned value is considered to be always valid. However,
when playing with HID-BPF, the return value can be arbitrary big,
because it's the return value of dispatch_hid_bpf_raw_requests(), which
calls the struct_ops and we have no guarantees that the value makes
sense.
Source : NVD
Published April 3, 2026
CNA Score N/A
Affected Technologies
Linux Kernel
Linux Debian
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 4.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
Bugzilla
CVE-2026-31401 kernel: HID: bpf: prevent buffer overflow in hid_hw_request
bugzilla·2026-04-03
CVE-2026-31401 [LOW] CVE-2026-31401 kernel: HID: bpf: prevent buffer overflow in hid_hw_request
CVE-2026-31401 kernel: HID: bpf: prevent buffer overflow in hid_hw_request
In the Linux kernel, the following vulnerability has been resolved:
HID: bpf: prevent buffer overflow in hid_hw_request
right now the returned value is considered to be always valid. However,
when playing with HID-BPF, the return value can be arbitrary big,
because it's the return value of dispatch_hid_bpf_raw_requests(), which
calls the struct_ops and we have no guarantees that the value makes
sense.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026040327-CVE-2026-31401-697d@gregkh/T
2026-04-03
Published