DEBIAN-CVE-2026-23178

In the Linux kernel, the following vulnerability has been resolved:  HID: i2c-hid: fix potential buffer overflow in i2chidgetreport()  `i2chidxfer is used to read recvlen + sizeof(__le16) bytes of data into ihid->rawbuf.  The former can come from the userspace in the hidraw driver and is only bounded by HIDMAXBUFFER_SIZE(16384) by default (unless we also set maxbuffersize field of struct hidlldriver which we do not).  The latter has size determined at runtime by the maximum size of different report types you could receive on any particular device and can be a much smaller value.  Fix this by truncating recvlen to ihid->bufsize - sizeof(_le16)`.  The impact is low since access to hidraw devices requires root.