CVE-2026-31624 PUBLISHED

HID: core: clamp report_size in s32ton() to avoid undefined shift

Assigner: Linux
Reserved: 09.03.2026 Published: 24.04.2026 Updated: 25.04.2026

In the Linux kernel, the following vulnerability has been resolved:

HID: core: clamp report_size in s32ton() to avoid undefined shift

s32ton() shifts by n-1 where n is the field's report_size, a value that comes directly from a HID device. The HID parser bounds report_size only to <= 256, so a broken HID device can supply a report descriptor with a wide field that triggers shift exponents up to 256 on a 32-bit type when an output report is built via hid_output_field() or hid_set_field().

Commit ec61b41918587 ("HID: core: fix shift-out-of-bounds in hid_report_raw_event") added the same n > 32 clamp to the function snto32(), but s32ton() was never given the same fix as I guess syzbot hadn't figured out how to fuzz a device the same way.

Fix this up by just clamping the max value of n, just like snto32() does.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from dde5845a529ff753364a6d1aea61180946270bfa to 58386f00af710922cafb0fb69211497beddfaa95 (excl.)
  • affected from dde5845a529ff753364a6d1aea61180946270bfa to 8a8333237f1f5caab8d4c3d2c2e7578c4263a97f (excl.)
  • affected from dde5845a529ff753364a6d1aea61180946270bfa to ea363a34086ddb4231adc581a7f36c39ec154bfc (excl.)
  • affected from dde5845a529ff753364a6d1aea61180946270bfa to 97014719bb8fccb1ffcbbc299e84b1f11b114195 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 2.6.20 is affected
  • unaffected from 0 to 2.6.20 (excl.)
  • unaffected from 6.12.83 to 6.12.* (incl.)
  • unaffected from 6.18.24 to 6.18.* (incl.)
  • unaffected from 6.19.14 to 6.19.* (incl.)
  • unaffected from 7.0.1 to 7.0.* (incl.)

References