Out-of-bounds Write Affecting linux-6.12 package, versions <6.12.100-1~deb12u1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-ECHOLATEST-LINUX612-18579215
- published7 Aug 2026
- disclosed25 Jul 2026
Introduced: 25 Jul 2026
CVE-2026-64367 (opens in a new tab)How to fix?
Upgrade Echo:latest linux-6.12 to version 6.12.100-1~deb12u1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream linux-6.12 package and not the linux-6.12 package as distributed by Echo.
See How to fix? for Echo:latest relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
goodix_hid_set_raw_report() builds a protocol frame in a 128-byte stack buffer (tmp_buf), writing an 11-12 byte header followed by the caller-supplied report data. The HID core caps report size at HID_MAX_BUFFER_SIZE (16384) by default, while the driver does not set hid_ll_driver.max_buffer_size and performs no bounds checking before copying the payload:
memcpy(tmp_buf + tx_len, buf, len);
A hidraw SET_REPORT ioctl with a report larger than ~116 bytes overflows the stack buffer.
Add a size check after constructing the header, rejecting reports that would exceed the buffer capacity.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
References
- https://advisory.echohq.com/cve/CVE-2026-64367
- https://git.kernel.org/stable/c/835fcc8655569737e3f057d42875a96259db74c2
- https://git.kernel.org/stable/c/ad47ad624f2fce0bc44bbadb664242461a97d774
- https://git.kernel.org/stable/c/dae1d000ddfd5c2140b036e47fff0c497ae9c64b
- https://git.kernel.org/stable/c/db0a0768d09273aadadeb76730cd658d720333a4