A stack buffer overflow vulnerability in the Linux kernel hid-goodix-spi driver allows local low-privileged attackers to achieve complete system compromise.

This vulnerability is a stack buffer overflow (CWE-121) caused by missing bounds checking in the goodix_hid_set_raw_report function, requiring low privileges and local access with no user interaction.

A successful exploit of this vulnerability can lead to complete confidentiality, integrity, and availability loss of the host operating system. With a CVSS score of 7.8, the risk is classified as high, as an attacker with local shell access can escalate privileges, compromise sensitive data, or cause kernel panics resulting in denial of service.

Immediate Action: Update the Linux kernel to version 6.12.96, 6.18.39, 7.1.4, or later depending on your release branch.

Proactive Monitoring: Monitor system logs for kernel panic events, unexpected segfaults, or unauthorized attempts to interact with hidraw devices.

Compensating Controls: Restrict local user access and apply principle-of-least-privilege permissions to limit who can execute untrusted code or access physical peripheral interfaces on the host.

Public Exploit Available: No (false / unknown)

Administrators must prioritize updating affected Linux kernel packages to the patched versions immediately to prevent potential privilege escalation. Testing and deploying these kernel updates in staging environments before rolling them out to production hosts is strongly recommended.