CVE-2026-43140
HID Input Null Pointer Dereference in Linux Kernel
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | kernel | to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (exc) |
| linux_kernel | magicmouse | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's handling of HID magicmouse devices. Fake USB devices can send their own report descriptors that bypass the usual input_mapping() hook. As a result, a pointer (msc->input) remains NULL, which later causes the system to crash.
The issue arises because the system does not detect this condition early enough. The fix involves detecting this condition in the input_configured() hook and rejecting the device to prevent the crash.
This vulnerability is not expected to occur with genuine magic mouse devices but can be triggered by pretending to be a magic mouse USB device.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash when it encounters a specially crafted fake USB device masquerading as a magic mouse. Such a crash can lead to denial of service, disrupting normal system operation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves fake USB devices sending their own report descriptors that cause the Linux kernel to crash due to a missing msc->input pointer.
Detection would involve monitoring for unusual USB devices that identify as a magic mouse but do not trigger the input_mapping() hook, leading to a NULL msc->input pointer.
However, no specific detection commands or tools are provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by detecting the problematic condition in the input_configured() hook and rejecting the device.
Immediate mitigation steps would include updating the Linux kernel to a version that includes this fix.
No other specific mitigation steps or workarounds are provided in the available information.