{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer  quickspi_hid_raw_request() receives the caller's buffer length in len, but quickspi_get_report() never sees it and copies the whole device-supplied response into buf regardless:      memcpy(buf, qsdev-\u003ereport_buf, qsdev-\u003ereport_len);  qsdev-\u003ereport_len comes from the input report the touch controller returns, while buf is sized to whatever the caller asked hidraw for through HIDIOCGFEATURE or HIDIOCGINPUT.  A response larger than that overflows buf with device-controlled content.  The intel-quicki2c sibling already passes the caller length down to quicki2c_get_report() and validates the response against it before the copy.  Do the same here.",
  "id": "DEBIAN-CVE-2026-89619",
  "modified": "2026-09-14T08:47:36.900878517Z",
  "published": "2026-09-11T20:19:47.163Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-89619"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-89619"
  ]
}