CVE-2026-80781: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-4wjj-fc9c-xhfj
Share
Published
Advisory Summary

CVE-2026-80781 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-80781 at a Glance

CVE Identifier CVE-2026-80781
GHSA Identifier GHSA-4wjj-fc9c-xhfj
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-80781

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-80781, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field->usage in hid_set_field() hid_set_field() hands field->usage + offset to hid_dump_input() before the guard that bounds offset: hid_dump_input(field->report->device, field->usage + offset, value); if (offset >= field->report_count) { hid_err(...); return -1; } Under CONFIG_DEBUG_FS hid_dump_input() dereferences that pointer, with buf = hid_resolv_usage(usage->hid, NULL). The usage[] array is allocated inline with the hid_field in hid_register_field() and holds field->maxusage entries, so an offset past it reads off the end of the kvzalloc()ed allocation and into a neighbouring object. Had the guard run first, offset < report_count <= maxusage would already have confined the pointer to the array. A caller supplies such an offset today. picolcd_fb_send_tile() validates only report->maxfield before issuing hid_set_field(report->field[0], 11 + i, ...) for i = 0..31, so its offsets are fixed at 11..42 and are never checked against the bound field. When the device registers that field with fewer usages, the framebuffer deferred-io work drives the read on every tile. KASAN reports a 4-byte slab-out-of-bounds read in hid_dump_input() below hid_set_field(), and the same boot logs "offset (1) exceeds report_count (1)" from the guard that runs only afterwards. Move the hid_dump_input() call below the guard. Because field->maxusage >= field->report_count, the guard then establishes that field->usage + offset lies inside the array before it is dereferenced, for every caller and without changing behaviour on the valid path. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

References

NVD — CVE-2026-80781 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80781
git.kernel.org/stable/c/313ead1abe... WEB
https://git.kernel.org/stable/c/313ead1abed945544703b100a12c5a10fdf78409
git.kernel.org/stable/c/465544b3d6... WEB
https://git.kernel.org/stable/c/465544b3d6602cfbdc2305d5cbfb7f4954353b63
git.kernel.org/stable/c/4993e1ab85... WEB
https://git.kernel.org/stable/c/4993e1ab85d7d3f4a40d81852170f9665483bbd8
git.kernel.org/stable/c/5215ea00a7... WEB
https://git.kernel.org/stable/c/5215ea00a747eca34cb2f603cfef91fef76c2558
git.kernel.org/stable/c/9a1d7c5f0d... WEB
https://git.kernel.org/stable/c/9a1d7c5f0d82e8665715d5e47c9410c6a97e3748
git.kernel.org/stable/c/a13cdb19fc... WEB
https://git.kernel.org/stable/c/a13cdb19fcb223ed41bdab3bab42b98dba87e90b
git.kernel.org/stable/c/a382126875... WEB
https://git.kernel.org/stable/c/a38212687519f2a72f43e62dec1348a690412404
git.kernel.org/stable/c/c1d9c16af5... WEB
https://git.kernel.org/stable/c/c1d9c16af51cc6ff92a5a062617d3b022dd01078
git.kernel.org/stable/c/cbcc0e8dea... WEB
https://git.kernel.org/stable/c/cbcc0e8dea499e5ca86b583372ccb1815cccc570

Frequently Asked Questions

What is CVE-2026-80781?
CVE-2026-80781 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-80781?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-80781?
CVE-2026-80781 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-80781?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4wjj-fc9c-xhfj",
  "modified" : "2026-09-04T18:31:25Z",
  "published" : "2026-09-04T18:31:25Z",
  "aliases" : [ "CVE-2026-80781" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: fix OOB read of field->usage in hid_set_field()\n\nhid_set_field() hands field->usage + offset to hid_dump_input() before\nthe guard that bounds offset:\n\n\thid_dump_input(field->report->device, field->usage + offset, value);\n\n\tif (offset >= field->report_count) {\n\t\thid_err(...);\n\t\treturn -1;\n\t}\n\nUnder CONFIG_DEBUG_FS hid_dump_input() dereferences that pointer, with\nbuf = hid_resolv_usage(usage->hid, NULL).  The usage[] array is\nallocated inline with the hid_field in hid_register_field() and holds\nfield->maxusage entries, so an offset past it reads off the end of the\nkvzalloc()ed allocation and into a neighbouring object.  Had the guard\nrun first, offset < report_count <= maxusage would already have confined\nthe pointer to the array.\n\nA caller supplies such an offset today.  picolcd_fb_send_tile()\nvalidates only report->maxfield before issuing\nhid_set_field(report->field[0], 11 + i, ...) for i = 0..31, so its\noffsets are fixed at 11..42 and are never checked against the bound\nfield.  When the device registers that field with fewer usages, the\nframebuffer deferred-io work drives the read on every tile.  KASAN\nreports a 4-byte slab-out-of-bounds read in hid_dump_input() below\nhid_set_field(), and the same boot logs \"offset (1) exceeds\nreport_count (1)\" from the guard that runs only afterwards.\n\nMove the hid_dump_input() call below the guard.  Because\nfield->maxusage >= field->report_count, the guard then establishes that\nfield->usage + offset lies inside the array before it is dereferenced,\nfor every caller and without changing behaviour on the valid path.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-80781"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/313ead1abed945544703b100a12c5a10fdf78409"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/465544b3d6602cfbdc2305d5cbfb7f4954353b63"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4993e1ab85d7d3f4a40d81852170f9665483bbd8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5215ea00a747eca34cb2f603cfef91fef76c2558"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9a1d7c5f0d82e8665715d5e47c9410c6a97e3748"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a13cdb19fcb223ed41bdab3bab42b98dba87e90b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a38212687519f2a72f43e62dec1348a690412404"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c1d9c16af51cc6ff92a5a062617d3b022dd01078"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cbcc0e8dea499e5ca86b583372ccb1815cccc570"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-04T16:18:03Z"
  }
}