Answer in brief
CVE-2026-31624 records a Unknown severity vulnerability in HID: core: clamp report_size in s32ton() to avoid undefined shift. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=dde5845a529ff753364a6d1aea61180946270bfa <76ad02854a30c394e0c076e6e6bed0a388573a94 || >=dde5845a529ff753364a6d1aea61180946270bfa <eb415ddaf25e09ddb8fe5736a70c9de2e6462534 || >=dde5845a529ff753364a6d1aea61180946270bfa <0ab048dbdb1daacf17d52e9252297eb6e1298e49 || >=dde5845a529ff753364a6d1aea61180946270bfa <932ae5309e53561197aa7d1606c7cf63af10e24f || >=dde5845a529ff753364a6d1aea61180946270bfa <58386f00af710922cafb0fb69211497beddfaa95 || >=dde5845a529ff753364a6d1aea61180946270bfa <8a8333237f1f5caab8d4c3d2c2e7578c4263a97f || >=dde5845a529ff753364a6d1aea61180946270bfa <ea363a34086ddb4231adc581a7f36c39ec154bfc || >=dde5845a529ff753364a6d1aea61180946270bfa <97014719bb8fccb1ffcbbc299e84b1f11b114195 || >=dde5845a529ff753364a6d1aea61180946270bfa <69c02ffde6ed4d535fa4e693a9e572729cad3d0d | 76ad02854a30c394e0c076e6e6bed0a388573a94, eb415ddaf25e09ddb8fe5736a70c9de2e6462534, 0ab048dbdb1daacf17d52e9252297eb6e1298e49, 932ae5309e53561197aa7d1606c7cf63af10e24f, 58386f00af710922cafb0fb69211497beddfaa95, 8a8333237f1f5caab8d4c3d2c2e7578c4263a97f, ea363a34086ddb4231adc581a7f36c39ec154bfc, 97014719bb8fccb1ffcbbc299e84b1f11b114195, 69c02ffde6ed4d535fa4e693a9e572729cad3d0d |
| Linux/Linuxgeneric | 2.6.20 | Not reported |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <* | * |
Published upstream
Apr 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 15, 2026
In the Linux kernel, the following vulnerability has been resolved: HID: core: clamp report_size in s32ton() to avoid undefined shift s32ton() shifts by n-1 where n is the field's report_size, a value that comes directly from a HID device. The HID parser bounds report_size only to <= 256, so a broken HID device can supply a report descriptor with a wide field that triggers shift exponents up to 256 on a 32-bit type when an output report is built via hid_output_field() or hid_set_field(). Commit ec61b41918587 ("HID: core: fix shift-out-of-bounds in hid_report_raw_event") added the same n > 32 clamp to the function snto32(), but s32ton() was never given the same fix as I guess syzbot hadn't figured out how to fuzz a device the same way. Fix this up by just clamping the max value of n, just like snto32() does.
Quoted source text, attributed separately from HOL analysis.