# CVE-2026-89619

## Summary

- **CVE ID:** CVE-2026-89619
- **Severity:** HIGH
- **CVSS Score:** 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 13, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer

quickspi_hid_raw_request() receives the caller's buffer length in len, but
quickspi_get_report() never sees it and copies the whole device-supplied
response into buf regardless:

    memcpy(buf, qsdev->report_buf, qsdev->report_len);

qsdev->report_len comes from the input report the touch controller returns,
while buf is sized to whatever the caller asked hidraw for through
HIDIOCGFEATURE or HIDIOCGINPUT.  A response larger than that overflows buf
with device-controlled content.

The intel-quicki2c sibling already passes the caller length down to
quicki2c_get_report() and validates the response against it before the
copy.  Do the same here.

## Affected Products

- Linux — Linux (4138f21115aec3ebae7805ec3407c72d93558023)
- Linux — Linux (6.14)
- Linux — Linux (0)
- Linux — Linux (6.18.50)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)

## References

- [CNA](https://git.kernel.org/stable/c/72706b44b665679d7d60a488d8776a911f1a93f3)
- [CNA](https://git.kernel.org/stable/c/54e0bafc0653bdf2a6c5f5f8ad8787a820d98663)
- [CNA](https://git.kernel.org/stable/c/035ec4a71cb8020a927c123bbe75c2f88d614986)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.14%
- **EPSS Percentile:** 3.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-19._