CVE-2026-31401
Published: 03 April 2026
Summary
CVE-2026-31401 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-31401 is a buffer overflow vulnerability in the Linux kernel's HID-BPF subsystem, specifically within the hid_hw_request function. The issue arises because the function assumes the return value from dispatch_hid_bpf_raw_requests()—which invokes struct_ops programs—is always valid, but HID-BPF programs can return arbitrarily large values without guarantees, leading to potential overflows when handling HID hardware requests.
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation enables high-impact confidentiality, integrity, and availability violations, such as arbitrary code execution, data corruption, or system crashes within the kernel context.
Mitigation involves applying the upstream kernel patches referenced in the stable repository, including commits 2b658c1c442ec1cd9eec5ead98d68662c40fe645, 73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1, d6efaa50af62fb0790dd1fd4e7e5506b46312510, and eb57dae20fdf6f3069cdc07821fa3bb46de381d7, which add validation to prevent the buffer overflow in hid_hw_request.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18784
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: HID: bpf: prevent buffer overflow in hid_hw_request right now the returned value is considered to be always valid. However, when playing with HID-BPF, the return value can be arbitrary big,…
more
because it's the return value of dispatch_hid_bpf_raw_requests(), which calls the struct_ops and we have no guarantees that the value makes sense.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel buffer overflow in HID-BPF with low-priv access enables arbitrary code execution and full system compromise, mapping directly to Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of information inputs such as return values from HID-BPF programs, directly preventing the buffer overflow in hid_hw_request by ensuring sizes are within safe bounds.
Mandates timely remediation of flaws, directly addressing this CVE through application of upstream kernel patches that add validation to hid_hw_request.
Implements memory protection mechanisms that mitigate exploitation of the buffer overflow by restricting unauthorized kernel memory access.