CVE-2026-98860

In the Linux kernel, the following vulnerability has been resolved:

HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request

As reported by Sashiko:

If a transport driver encounters a hardware error and returns a negative

error code such as -EPIPE, ret is implicitly promoted to size_t when

compared against size. This causes the negative error code to evaluate

as a large positive number, making the (ret > size) condition true.

This silently converts the hardware error into a success return value

and copies the unmodified buffer back, which could leave BPF programs

operating on uninitialized or stale data.

Fix this by casting size into ssize_t to return the actual negative

error code.