---
id: CVE-2026-98860
title: >-
  kernel: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
  (CVE-2026-98860)
summary: >-
  A flaw was found in the Linux kernel's Human Interface Device (HID) subsystem.
  This flaw can lead to information disclosure when hardware communication
  errors occur. Due to an improper integer comparison in the Berkeley Packet
  Filter (BPF)…
severity: low
cvss: 1.9
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N'
cvssSource: vendor
cwe: CWE-908
vendor: Red Hat
product: Red Hat Enterprise Linux 10
affected:
  - enterprise_linux 10
published: '2026-10-18'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T06:31:40+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98860.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98860.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98860'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555220'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98860'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98860'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98860.mbox
  - url: 'https://git.kernel.org/stable/c/8b85ef0f561039e249c3f883c5280a1449c6dbee'
  - url: 'https://git.kernel.org/stable/c/97be6396817bd3b11d06239010d27902940bfaa9'
  - url: 'https://git.kernel.org/stable/c/f9f808227554b2c116fd07dd2328ecd74ea3f411'
  - url: 'https://git.kernel.org/stable/c/3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00157
epssPercentile: 0.04783
ingestedAt: '2026-10-18T16:47:32.459Z'
---

## Overview

A flaw was found in the Linux kernel's Human Interface Device (HID) subsystem. This flaw can lead to information disclosure when hardware communication errors occur. Due to an improper integer comparison in the Berkeley Packet Filter (BPF) handler, negative error return codes are mistakenly treated as a valid buffer size, causing failed device requests to be reported as successful. A local user running BPF programs can leverage this issue to process unmodified buffers containing uninitialized or stale data.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-10-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98860.json)

**kernel: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request** — rated Low by Red Hat. Released 2026-10-18, updated 2026-10-24.

Affected:

- Red Hat Enterprise Linux 10

No fix planned:

- Red Hat Enterprise Linux 10

Not affected:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Fix deferred