CVE-2026-23178: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23178 is a potential buffer overflow vulnerability in the Linux kernel's HID i2c-hid driver, specifically in the i2c_hid_get_report() function. The flaw arises because recv_len, which can be supplied from userspace via the hidraw driver, is not properly bounded before being used to determine how many bytes to read into ihid->rawbuf. It affects the Linux kernel and was published on February 14, 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Feedly).

The root cause is insufficient input validation (CWE-120, Buffer Copy without Checking Size of Input) in the i2c_hid_get_report() function of the HID: i2c-hid kernel subsystem. The i2c_hid_xfer function reads recv_len + sizeof(__le16) bytes into ihid->rawbuf, where recv_len can originate from userspace via the hidraw interface and is only bounded by HID_MAX_BUFFER_SIZE (16384 bytes) by default — potentially far exceeding the actual allocated buffer size, which is determined at runtime based on the maximum report size for the specific device. The fix truncates recv_len to ihid->bufsize - sizeof(__le16) before the transfer. Patches are available in the Linux kernel stable tree at multiple commit references including 786ec171, 2497ff38, 2124279f, cff3f619, and f9c9ad89 (Feedly).

Successful exploitation could result in high confidentiality, integrity, and availability impact on the affected system, as reflected in the CVSS score. An attacker with local access and privileges sufficient to access hidraw devices (typically root) could trigger a buffer overflow, potentially leading to kernel memory corruption, information disclosure, or a system crash. The vendor notes that practical impact is low since access to hidraw devices requires root privileges (Feedly).

Apply the upstream Linux kernel patches that truncate recv_len to ihid->bufsize - sizeof(__le16) in i2c_hid_get_report(). Patches have been incorporated into multiple stable kernel branches (commits 786ec171, 2497ff38, 2124279f, cff3f619, f9c9ad89). Downstream distributions including Debian (DSA-6141-1, DSA-6163-1, DLA-4499-1), Ubuntu (USN-8393-1), and Oracle Linux (ELSA-2026-50160, ELSA-2026-50232) have released updated kernel packages — administrators should apply the relevant distribution update promptly (Feedly, Debian LTS).