CVE-2026-80774
Received Received - Intake

HID USB Interface Validation Flaw in Linux Kernel

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't actually have a USB parent. Fix the use of to_usb_interface() without a hid_is_usb() check. I have verified that it is currently possible to trigger a kernel splat due to this bug in an ASAN build, and that this commit fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80774
EUVD
EUVD-2026-71417

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where the HID (Human Interface Device) driver for ASUS devices fails to properly check if a device is connected via USB before using a USB-specific function. This can lead to kernel errors or crashes when non-USB devices are incorrectly treated as USB devices.

Detection Guidance

This vulnerability is specific to the Linux kernel's HID subsystem and does not have network-based detection methods. To detect it, check if your kernel version includes the fix for the missing hid_is_usb() check in the ASUS HID driver. Use uname -r to check the kernel version and compare it against patched versions.

Impact Analysis

This vulnerability could cause system instability or crashes if a non-USB HID device is misidentified as USB. It may result in kernel errors (kernel splat) and potential denial-of-service conditions on affected systems.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for this vulnerability. This can typically be done via your distribution's package manager (e.g., apt upgrade, yum update). If a patched kernel is not yet available, consider applying the upstream patch manually or restricting access to vulnerable systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80774. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart