CVE-2021-46906: HID: usbhid: fix info leak in hid_submit_ctrl
Vulnerability summary
CVE-2021-46906 is a medium (CVSS 5.5) Exposure of Resource to Wrong Sphere vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 15.8% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 26-02-2024PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix info leak in hid_submit_ctrl In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes. To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl().
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.24% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu87 products
- linuxAll versions (No fix recorded) | < 4.4.0-258.292 | < 4.15.0-156.163 | < 5.4.0-81.91
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 4.4.0-1135.141 | < 4.4.0-1173.188 | < 4.15.0-1111.118 | < 5.4.0-1055.58
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < c5d3c142f2d57d40c55e65d5622d319125a45366 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 41b1e71a2c57366b08dcca1a28b0d45ca69429ce | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 8c064eece9a51856f3f275104520c7e3017fc5c0 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 0e280502be1b003c3483ae03fc60dea554fcfa82 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 7f5a4b24cdbd7372770a02f23e347d7d9a9ac8f1 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < b1e3596416d74ce95cc0b7b38472329a3818f8a9 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 21883bff0fd854e07429a773ff18f1e9658f50e8 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 6be388f4a35d2ce5ef7dbf635a8964a5da7f799f | 2.6.12
- linux_kernel< 4.4.274 | ≥ 4.5.0, < 4.9.274 | ≥ 4.10.0, < 4.14.238 | ≥ 4.15.0, < 4.19.196 | ≥ 4.20.0, < 5.4.127 | ≥ 5.5.0, < 5.10.45 | ≥ 5.11.0, < 5.12.12
Debian1 product
- linux< 5.14.6-1
3 vendors · 90 products
