CVE-2026-31624: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31624 is a shift-out-of-bounds vulnerability in the Linux kernel's HID (Human Interface Device) core subsystem, specifically in the s32ton() function. A malicious or broken HID device can supply a crafted report descriptor with an oversized field, triggering undefined bitwise shift operations on 32-bit integer types during output report construction. The vulnerability affects Linux kernel versions from 2.6.20 through multiple stable branches, with fixed versions at 6.6.136, 6.12.83, 6.18.24, 6.19.14, and 7.0.1. It was published on April 24, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an incorrect bitwise shift of an integer (CWE-1335): the s32ton() function shifts by n-1 where n is the field's report_size, a value sourced directly from the HID device descriptor. The HID parser only bounds report_size to ≤ 256, so a crafted descriptor can cause shift exponents up to 256 on a 32-bit type — undefined behavior in C — when output reports are built via hid_output_field() or hid_set_field(). A prior commit (ec61b41918587, "HID: core: fix shift-out-of-bounds in hid_report_raw_event") applied the same n > 32 clamp to the companion function snto32(), but s32ton() was overlooked. The fix mirrors the snto32() approach by clamping the maximum value of n to 32 before performing the shift (GitHub Advisory).

Successful exploitation can cause kernel instability or a denial of service (system crash/panic) by triggering undefined behavior in the kernel's HID processing path. There is no confidentiality or integrity impact identified — the primary risk is availability loss on the affected system. Exploitation requires local physical access to connect a malicious HID device (e.g., a specially crafted USB keyboard or mouse), limiting the attack surface to scenarios where an attacker has physical or privileged local access (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing (GitHub Advisory). The vulnerability was likely identified through kernel fuzzing (syzbot-style analysis), as noted in the commit message. The EPSS score is 0.000180 (approximately 0.018%), reflecting very low probability of near-term exploitation. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution is available.

Update the Linux kernel to a patched version: 6.6.136, 6.12.83, 6.18.24, 6.19.14, or 7.0.1 (or later), depending on the branch in use. Kernel commits addressing this issue are available in the stable kernel trees (kernel.org patches). As a workaround in high-security environments, restrict physical access to systems, disable unused USB ports, or implement HID device allowlisting to prevent untrusted peripherals from being connected. Amazon Linux 2023 users can apply the fix via ALAS2023-2026-1817.