HID: mcp2221: validate report size in mcp2221_raw_event() (CVE-2026-89621) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-89621

HID: mcp2221: validate report size in mcp2221_raw_event()

Answer in brief

CVE-2026-89621 records a Unknown severity vulnerability in HID: mcp2221: validate report size in mcp2221_raw_event(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 11, 2026Updated Sep 11, 2026Source checked Sep 11, 2026First seen by HOL Sep 11, 2026Material review Sep 11, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=67a95c21463d066060b0f66d65a75d45bb386ffb <bdc6a3af0dd734a326acdb7d6401a3b6a9f4f149 \|\| >=67a95c21463d066060b0f66d65a75d45bb386ffb <127de5919820f88a9d55e8371ad4ac49f625f4c5 \|\| >=67a95c21463d066060b0f66d65a75d45bb386ffb <7c18fb36708a97ff6772825cc087b6d537bbf0d5 \|\| >=67a95c21463d066060b0f66d65a75d45bb386ffb <2c9a6998c19503626c57a2267bf279e204113079	bdc6a3af0dd734a326acdb7d6401a3b6a9f4f149, 127de5919820f88a9d55e8371ad4ac49f625f4c5, 7c18fb36708a97ff6772825cc087b6d537bbf0d5, 2c9a6998c19503626c57a2267bf279e204113079
Linux/Linuxgeneric	5.7	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to bdc6a3af0dd734a326acdb7d6401a3b6a9f4f149 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 11, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221_raw_event() mcp2221_raw_event() never validates the size of incoming HID reports. In the MCP2221_I2C_GET_DATA path it trusts the device-supplied data[3] as the copy length without checking that 4 + data[3] bytes actually exist in the received report. A malicious or misbehaving USB device can send a short report with a large data[3], causing the memcpy to read past the valid report data in the HID transfer buffer and leak uninitialized kernel memory back to userspace through the I2C/SMBus read path. Add a minimum size check at entry and validate that the source range fits within the received report before the copy.

Quoted source text, attributed separately from HOL analysis.