CVE-2026-80782
Received Received - Intake

Use-After-Free in Linux Kernel HID MagicMouse Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a stale msc->input if no input is claimed magicmouse_input_mapping() caches the first hid_input's input_dev in msc->input while the report descriptor is parsed, and the rest of the driver treats a non-NULL msc->input as proof that an input device was registered. That does not hold on the hid-input error path. If hidinput_connect() fails -- for instance because input_register_device() returns an error -- it unwinds through hidinput_disconnect(), which frees every input_dev it created, including the one cached in msc->input. The failure does not abort the probe. hid_connect() only skips the claim: if ((connect_mask & HID_CONNECT_HIDINPUT) && !hidinput_connect(hdev, connect_mask & HID_CONNECT_HIDINPUT_FORCE)) hdev->claimed |= HID_CLAIMED_INPUT; and the "device has no listeners" bailout below it does not fire for this driver, which sets ->raw_event; on the USB Magic Mouse 2 / Magic Trackpad 2 paths hidraw and hiddev are claimed as well. hid_hw_start() therefore returns 0 and magicmouse_probe() continues with msc->input pointing at freed memory. Being non-NULL, it passes the "input not registered" check in probe and the NULL checks in ->raw_event and ->event, so the next input report dereferences freed memory. Clear msc->input when the HID core did not claim an input device, so the existing NULL checks cover this case as well.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80782
EUVD
EUVD-2026-71425

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's HID driver for Apple Magic Mouse and Trackpad devices. The issue occurs when the driver fails to properly handle errors during input device registration, leading to a cached pointer pointing to freed memory. This freed memory is later accessed, causing a potential system crash or privilege escalation.

Detection Guidance

This vulnerability is specific to the Linux kernel's HID driver for Apple Magic Mouse and Trackpad devices. Detection requires checking the kernel version and the presence of the affected driver. Use commands like 'uname -a' to check the kernel version and 'lsmod | grep magicmouse' to see if the vulnerable module is loaded.

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to crash the system or execute arbitrary code with kernel privileges. This could lead to denial of service, data corruption, or unauthorized system access on affected Linux systems using the magicmouse driver.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. If immediate updating is not possible, consider unloading the magicmouse module with 'modprobe -r magicmouse' to prevent exploitation until a permanent fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80782. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart