CVE-2026-64367: HID: hid-goodix-spi: validate report size to prevent stack buffer overflow

CVE-2026-64367: HID: hid-goodix-spi: validate report size to prevent stack buffer overflow

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

HID: hid-goodix-spi: validate report size to prevent stack buffer overflow

goodix_hid_set_raw_report() builds a protocol frame in a 128-byte stack
buffer (tmp_buf), writing an 11-12 byte header followed by the
caller-supplied report data.  The HID core caps report size at
HID_MAX_BUFFER_SIZE (16384) by default, while the driver does not set
hid_ll_driver.max_buffer_size and performs no bounds checking before
copying the payload:

    memcpy(tmp_buf + tx_len, buf, len);

A hidraw SET_REPORT ioctl with a report larger than ~116 bytes
overflows the stack buffer.

Add a size check after constructing the header, rejecting reports that
would exceed the buffer capacity.

Discovered by Atuin - Automated Vulnerability Discovery Engine.

The Linux kernel CVE team has assigned CVE-2026-64367 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.12 with commit 75e16c8ce283bb88e77704dc8fa041c577caac0f and fixed in 6.12.96 with commit ad47ad624f2fce0bc44bbadb664242461a97d774
	Issue introduced in 6.12 with commit 75e16c8ce283bb88e77704dc8fa041c577caac0f and fixed in 6.18.39 with commit dae1d000ddfd5c2140b036e47fff0c497ae9c64b
	Issue introduced in 6.12 with commit 75e16c8ce283bb88e77704dc8fa041c577caac0f and fixed in 7.1.4 with commit 835fcc8655569737e3f057d42875a96259db74c2
	Issue introduced in 6.12 with commit 75e16c8ce283bb88e77704dc8fa041c577caac0f and fixed in 7.2-rc1 with commit db0a0768d09273aadadeb76730cd658d720333a4

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64367
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/hid/hid-goodix-spi.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ad47ad624f2fce0bc44bbadb664242461a97d774
	https://git.kernel.org/stable/c/dae1d000ddfd5c2140b036e47fff0c497ae9c64b
	https://git.kernel.org/stable/c/835fcc8655569737e3f057d42875a96259db74c2
	https://git.kernel.org/stable/c/db0a0768d09273aadadeb76730cd658d720333a4