PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31401 Linux CVE debrief

CVE-2026-31401 is a Linux kernel HID-BPF buffer overflow issue in hid_hw_request. Per the CVE description, the code assumes the returned value is always valid, but dispatch_hid_bpf_raw_requests() can return an arbitrarily large value through struct_ops, creating an unchecked size condition that can overflow a buffer. NVD assigns CVSS 7.8 (HIGH) with local, low-complexity, low-privilege impact and lists affected Linux kernel branches in the 6.11, 6.13, 6.19, and 7.0-rc lines.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-07-24
Advisory published
2026-04-03
Advisory updated
2026-07-24

Who should care

Linux kernel maintainers, distro security teams, and operators running kernels with HID-BPF support should review this issue. It matters most on systems where local users or local workloads can reach the affected kernel path.

Technical summary

NVD classifies the flaw as CWE-787 (out-of-bounds write/buffer overflow). The supplied description says hid_hw_request trusts the return value from dispatch_hid_bpf_raw_requests(), but that value can be arbitrarily large when HID-BPF struct_ops are involved. NVD’s CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a locally reachable kernel memory corruption bug with potentially severe confidentiality, integrity, and availability impact. NVD’s vulnerable CPE ranges include Linux kernel 6.11 through before 6.12.78, 6.13 through before 6.18.20, 6.19 through before 6.19.10, and 7.0-rc1 through 7.0-rc4.

Defensive priority

High

Recommended defensive actions

  • Apply the referenced Linux kernel fixes from the official stable/kernel.org patch links.
  • Upgrade affected kernels out of the vulnerable ranges listed by NVD, or ensure your vendor kernel includes the backport.
  • Verify any downstream or distro kernel builds have incorporated the HID-BPF fix, not just the upstream commit.
  • Prioritize hosts that allow untrusted local users, containers, or sandbox escapes to reach the kernel path.
  • Track vendor advisories for exact fixed package versions if you rely on distribution backports.

Evidence notes

The description and severity/vector come from the supplied NVD record. Affected-version ranges are taken from the NVD CPE criteria in the source item. The four kernel.org URLs are official patch references, but the patch contents themselves were not included in the supplied corpus, so this debrief avoids claiming exact code changes beyond the CVE description.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-31401 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-31401

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-31401 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-31401

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2b658c1c442ec1cd9eec5ead98d68662c40fe645

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d6efaa50af62fb0790dd1fd4e7e5506b46312510

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/eb57dae20fdf6f3069cdc07821fa3bb46de381d7

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.