Answer in brief
CVE-2026-98860 records a Unknown severity vulnerability in HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d6efaa50af62fb0790dd1fd4e7e5506b46312510 <8b85ef0f561039e249c3f883c5280a1449c6dbee || >=73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1 <97be6396817bd3b11d06239010d27902940bfaa9 || >=2b658c1c442ec1cd9eec5ead98d68662c40fe645 <f9f808227554b2c116fd07dd2328ecd74ea3f411 || >=2b658c1c442ec1cd9eec5ead98d68662c40fe645 <3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c || eb57dae20fdf6f3069cdc07821fa3bb46de381d7 || >=6.12.78 <6.12.113 || >=6.18.20 <6.18.56 || >=6.19.10 <6.20 | 8b85ef0f561039e249c3f883c5280a1449c6dbee, 97be6396817bd3b11d06239010d27902940bfaa9, f9f808227554b2c116fd07dd2328ecd74ea3f411, 3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c, 6.12.113, 6.18.56, 6.20 |
| Linux/Linuxgeneric | 7.0 | Not reported |
Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 18, 2026
In the Linux kernel, the following vulnerability has been resolved: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -EPIPE, ret is implicitly promoted to size_t when compared against size. This causes the negative error code to evaluate as a large positive number, making the (ret > size) condition true. This silently converts the hardware error into a success return value and copies the unmodified buffer back, which could leave BPF programs operating on uninitialized or stale data. Fix this by casting size into ssize_t to return the actual negative error code.
Quoted source text, attributed separately from HOL analysis.