CVE intelligence

CVE-2026-98860

Vulnerability intelligence

Published Oct 18, 2026Sources checked Nov 10, 2026

N/ACVSS not listedScore unavailable

What this means

Review the available evidence

CVE-2026-98860. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-98860?

In the Linux kernel, the following vulnerability has been resolved:

HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request

As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -EPIPE, ret is implicitly promoted to size_t when compared against size. This causes the negative error code to evaluate as a large positive number, making the (ret > size) condition true.

This silently converts the hardware error into a success return value and copies the unmodified buffer back, which could leave BPF programs operating on uninitialized or stale data.

Fix this by casting size into ssize_t to return the actual negative error code.

Source: NVD