---
id: CVE-2026-89621
title: 'HID: mcp2221: validate report size in mcp2221_raw_event()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  HID: mcp2221: validate report size in mcp2221_raw_event()

  mcp2221_raw_event() never validates the size of incoming HID reports.
  In the MCP2221_I2C_GET_DATA path it tru…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-125
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 67a95c21463d066060b0f66d65a75d45bb386ffb <
    cb38b1f149b7143355b37e86c841acf0076e5c2a
  - >-
    Linux >= 67a95c21463d066060b0f66d65a75d45bb386ffb <
    b2c67dc0e30c308647bbd9b9e5d69a44c9d2733d
  - >-
    Linux >= 67a95c21463d066060b0f66d65a75d45bb386ffb <
    fffcfa367072628c3144cca17d2a3c3c9e50c057
  - >-
    Linux >= 67a95c21463d066060b0f66d65a75d45bb386ffb <
    c1c508e8923911cb458234997e55b7a4b9aa066f
  - >-
    Linux >= 67a95c21463d066060b0f66d65a75d45bb386ffb <
    bdc6a3af0dd734a326acdb7d6401a3b6a9f4f149
  - >-
    Linux >= 67a95c21463d066060b0f66d65a75d45bb386ffb <
    127de5919820f88a9d55e8371ad4ac49f625f4c5
  - >-
    Linux >= 67a95c21463d066060b0f66d65a75d45bb386ffb <
    7c18fb36708a97ff6772825cc087b6d537bbf0d5
  - >-
    Linux >= 67a95c21463d066060b0f66d65a75d45bb386ffb <
    2c9a6998c19503626c57a2267bf279e204113079
  - Linux 5.7
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:49:53.686Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89621'
references:
  - url: 'https://git.kernel.org/stable/c/cb38b1f149b7143355b37e86c841acf0076e5c2a'
  - url: 'https://git.kernel.org/stable/c/b2c67dc0e30c308647bbd9b9e5d69a44c9d2733d'
  - url: 'https://git.kernel.org/stable/c/fffcfa367072628c3144cca17d2a3c3c9e50c057'
  - url: 'https://git.kernel.org/stable/c/c1c508e8923911cb458234997e55b7a4b9aa066f'
  - url: 'https://git.kernel.org/stable/c/bdc6a3af0dd734a326acdb7d6401a3b6a9f4f149'
  - url: 'https://git.kernel.org/stable/c/127de5919820f88a9d55e8371ad4ac49f625f4c5'
  - url: 'https://git.kernel.org/stable/c/7c18fb36708a97ff6772825cc087b6d537bbf0d5'
  - url: 'https://git.kernel.org/stable/c/2c9a6998c19503626c57a2267bf279e204113079'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89621.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89621'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532406'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89621'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89621'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89621.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.0022
epssPercentile: 0.12451
ingestedAt: '2026-09-14T15:23:07.450Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

HID: mcp2221: validate report size in mcp2221_raw_event()

mcp2221_raw_event() never validates the size of incoming HID reports.
In the MCP2221_I2C_GET_DATA path it trusts the device-supplied data[3]
as the copy length without checking that 4 + data[3] bytes actually
exist in the received report. A malicious or misbehaving USB device can
send a short report with a large data[3], causing the memcpy to read
past the valid report data in the HID transfer buffer and leak
uninitialized kernel memory back to userspace through the I2C/SMBus
read path.

Add a minimum size check at entry and validate that the source range
fits within the received report before the copy.

## Affected

- `Linux >= 67a95c21463d066060b0f66d65a75d45bb386ffb < cb38b1f149b7143355b37e86c841acf0076e5c2a`
- `Linux >= 67a95c21463d066060b0f66d65a75d45bb386ffb < b2c67dc0e30c308647bbd9b9e5d69a44c9d2733d`
- `Linux >= 67a95c21463d066060b0f66d65a75d45bb386ffb < fffcfa367072628c3144cca17d2a3c3c9e50c057`
- `Linux >= 67a95c21463d066060b0f66d65a75d45bb386ffb < c1c508e8923911cb458234997e55b7a4b9aa066f`
- `Linux >= 67a95c21463d066060b0f66d65a75d45bb386ffb < bdc6a3af0dd734a326acdb7d6401a3b6a9f4f149`
- `Linux >= 67a95c21463d066060b0f66d65a75d45bb386ffb < 127de5919820f88a9d55e8371ad4ac49f625f4c5`
- `Linux >= 67a95c21463d066060b0f66d65a75d45bb386ffb < 7c18fb36708a97ff6772825cc087b6d537bbf0d5`
- `Linux >= 67a95c21463d066060b0f66d65a75d45bb386ffb < 2c9a6998c19503626c57a2267bf279e204113079`
- `Linux 5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89621.json)