---
id: CVE-2026-89620
title: 'HID: intel-thc-hid: intel-quickspi: validate report size before copy'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  HID: intel-thc-hid: intel-quickspi: validate report size before copy

  write_cmd_to_txdma() builds an output report in qsdev->report_buf, a heap
  buffer allocated in quic…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-120
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9d8d51735a3af40b722346931a6a1e50227df4b5 <
    6fcefe71aeb524f6e77fe586fe85d873745e917c
  - >-
    Linux >= 9d8d51735a3af40b722346931a6a1e50227df4b5 <
    ee8ad1bb1e96164d51089b1182f1bd5f187e7baa
  - >-
    Linux >= 9d8d51735a3af40b722346931a6a1e50227df4b5 <
    a59cf84441f9a17323c89452cec2bf16724c48a9
  - Linux 6.14
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:49:52.704Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89620'
references:
  - url: 'https://git.kernel.org/stable/c/6fcefe71aeb524f6e77fe586fe85d873745e917c'
  - url: 'https://git.kernel.org/stable/c/ee8ad1bb1e96164d51089b1182f1bd5f187e7baa'
  - url: 'https://git.kernel.org/stable/c/a59cf84441f9a17323c89452cec2bf16724c48a9'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89620.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89620'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532028'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89620'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89620'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89620.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00173
epssPercentile: 0.06728
scores:
  cna: 7.8
  vendor: 7
ingestedAt: '2026-09-14T15:23:07.474Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

HID: intel-thc-hid: intel-quickspi: validate report size before copy

write_cmd_to_txdma() builds an output report in qsdev->report_buf, a heap
buffer allocated in quickspi_alloc_report_buf() to the device-descriptor
derived max_report_len (a few hundred bytes for a touch controller).  It
copies the caller-supplied report into that buffer:

    memcpy(write_buf->content, report_buf, report_buf_len);

The HID core caps a report at HID_MAX_BUFFER_SIZE (16384) by default, and
quickspi_hid_ll_driver does not set max_buffer_size, so the length reaches
the driver unbounded.  A hidraw SET_REPORT/SET_FEATURE ioctl carrying a
report larger than max_report_len therefore overflows report_buf with
attacker-controlled length and content.

Record the report_buf allocation size and reject reports that do not fit
before copying, matching the equivalent guard in the intel-quicki2c
sibling (quicki2c_init_write_buf()) and the hid-goodix-spi fix.

write_cmd_to_txdma() writes the output report header ahead of the content
in the same buffer, so size the allocation to cover the header as well.
That keeps the added bound from rejecting a maximum-sized report.

## Affected

- `Linux >= 9d8d51735a3af40b722346931a6a1e50227df4b5 < 6fcefe71aeb524f6e77fe586fe85d873745e917c`
- `Linux >= 9d8d51735a3af40b722346931a6a1e50227df4b5 < ee8ad1bb1e96164d51089b1182f1bd5f187e7baa`
- `Linux >= 9d8d51735a3af40b722346931a6a1e50227df4b5 < a59cf84441f9a17323c89452cec2bf16724c48a9`
- `Linux 6.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-09-27 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89620.json)