Re: [PATCH] HID: lenovo: Fix buffer over-read and unaligned access in X12 Tab raw_event handler

[Benjamin Tissoires]

On Thu, 14 May 2026 20:58:38 +0800, Kean wrote:
> In lenovo_raw_event(), the X12 Tab keyboard handler reads a 4-byte
> little-endian value from the raw HID report buffer but:
> 
>   1. The size guard is size >= 3, while the access reads 4 bytes.
>      A malformed 3-byte report with ID 0x03 would over-read the
>      buffer by one byte.
> 
> [...]

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git (for-7.1/upstream-fixes), thanks!

[1/1] HID: lenovo: Fix buffer over-read and unaligned access in X12 Tab raw_event handler
      https://git.kernel.org/hid/hid/c/c7ee0b73c8c4

Cheers,
-- 
Benjamin Tissoires <bentiss@xxxxxxxxxx>