CVE-2026-89620

In the Linux kernel, the following vulnerability has been resolved:

HID: intel-thc-hid: intel-quickspi: validate report size before copy

write cmd to txdma() builds an output report in qsdev->report buf, a heap buffer allocated in quickspi alloc report buf() to the device-descriptor derived max report len (a few hundred bytes for a touch controller). It copies the caller-supplied report into that buffer:

memcpy(write buf->content, report buf, report buf len);

The HID core caps a report at HID MAX BUFFER SIZE (16384) by default, and quickspi hid ll driver does not set max buffer size, so the length reaches the driver unbounded. A hidraw SET REPORT/SET FEATURE ioctl carrying a report larger than max report len therefore overflows report buf with attacker-controlled length and content.

Record the report buf allocation size and reject reports that do not fit before copying, matching the equivalent guard in the intel-quicki2c sibling (quicki2c init write buf()) and the hid-goodix-spi fix.

write cmd to txdma() writes the output report header ahead of the content in the same buffer, so size the allocation to cover the header as well. That keeps the added bound from rejecting a maximum-sized report.