---
id: CVE-2026-98860
title: 'HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request

  As reported by Sashiko:
  If a transport driver encounters a hardware error and returns a negative
  error …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d6efaa50af62fb0790dd1fd4e7e5506b46312510 <
    8b85ef0f561039e249c3f883c5280a1449c6dbee
  - >-
    Linux >= 73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1 <
    97be6396817bd3b11d06239010d27902940bfaa9
  - >-
    Linux >= 2b658c1c442ec1cd9eec5ead98d68662c40fe645 <
    f9f808227554b2c116fd07dd2328ecd74ea3f411
  - >-
    Linux >= 2b658c1c442ec1cd9eec5ead98d68662c40fe645 <
    3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c
  - Linux eb57dae20fdf6f3069cdc07821fa3bb46de381d7
  - Linux >= 6.12.78 < 6.12.113
  - Linux >= 6.18.20 < 6.18.56
  - Linux >= 6.19.10 < 6.20
  - Linux 7.0
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:51:21.403Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98860'
references:
  - url: 'https://git.kernel.org/stable/c/8b85ef0f561039e249c3f883c5280a1449c6dbee'
  - url: 'https://git.kernel.org/stable/c/97be6396817bd3b11d06239010d27902940bfaa9'
  - url: 'https://git.kernel.org/stable/c/f9f808227554b2c116fd07dd2328ecd74ea3f411'
  - url: 'https://git.kernel.org/stable/c/3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.459Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request

As reported by Sashiko:
If a transport driver encounters a hardware error and returns a negative
error code such as -EPIPE, ret is implicitly promoted to size_t when
compared against size. This causes the negative error code to evaluate
as a large positive number, making the (ret > size) condition true.

This silently converts the hardware error into a success return value
and copies the unmodified buffer back, which could leave BPF programs
operating on uninitialized or stale data.

Fix this by casting size into ssize_t to return the actual negative
error code.

## Affected

- `Linux >= d6efaa50af62fb0790dd1fd4e7e5506b46312510 < 8b85ef0f561039e249c3f883c5280a1449c6dbee`
- `Linux >= 73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1 < 97be6396817bd3b11d06239010d27902940bfaa9`
- `Linux >= 2b658c1c442ec1cd9eec5ead98d68662c40fe645 < f9f808227554b2c116fd07dd2328ecd74ea3f411`
- `Linux >= 2b658c1c442ec1cd9eec5ead98d68662c40fe645 < 3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c`
- `Linux eb57dae20fdf6f3069cdc07821fa3bb46de381d7`
- `Linux >= 6.12.78 < 6.12.113`
- `Linux >= 6.18.20 < 6.18.56`
- `Linux >= 6.19.10 < 6.20`
- `Linux 7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.