From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A851A4A014D for ; Fri, 4 Sep 2026 15:15:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788534928; cv=none; b=lwpC5H3xeymcVQRHcSANdG9cVB37TeYWiqlh2nmIauk3DLy2HuwS4r0cYcqGS3zuwRxWvxqgUmWL922p3jFK2vJtyuzWmuMDO7JWNlMsVdxvcuD/v/5FFjaNzDgyH2R1tTVJo6OeQwgOnyvV+xcuwFswJWIP4e4HwIGmxX77n1g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788534928; c=relaxed/simple; bh=aPjKy9OU0cGUYzvokOX29IZYrCSZEj05M6qkYUkUfxE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=t7JcdDnF6p7pZFfAo5sCZtfRbVxqDGgTEsxAB1XvjhFXlyGCig3TnhhD8BQCmUys3Dez3YjWE9zRshaOQNKHYiV5F9cEfw5cXwoyoYyioCrLHb7rs+huXueQswfswQQJ/JCuPP8u2hHCkz7c4KYh5z2lryialUYyd8yIYJeEFEk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QtYhbNiA; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="QtYhbNiA" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 12B9D1F00A3D; Fri, 4 Sep 2026 15:15:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788534925; bh=8KLgHXCwu5RMlWEZ5DImct0DZKwUqFWJW09WGCXbul0=; h=From:To:Cc:Subject:Date:Reply-To; b=QtYhbNiAlUUbOcP4uXZMlJGsFO28KsbTk/HY9nqfC4nx3uISbDwLBtEnjjJ5n3sg5 S9ibDS6G0mMK4li1k2kzYuF7eptJxHj8fAHrvZNlgtXfN0vZKRsy5scMaGFvaSgiu2 N2YNgrxBT7IupejGRSKRWZU8gf9htonpHG/ciu84= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-80782: HID: magicmouse: do not keep a stale msc->input if no input is claimed Date: Fri, 4 Sep 2026 17:11:21 +0200 Message-ID: <2026090404-CVE-2026-80782-89cf@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4799; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=Cw3UX1AdH9I6/BbCwYYqzHXxw503qPPqC+d6gwzyMjo=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmz7nfI2SU+16mVEuA4NeOWsZCCWVevxIaULSEScZ9SR FY8DLTriGVhEGRikBVTZPmyjefo/opDil6Gtqdh5rAygQxh4OIUgInMNGWYw2FioBL2sUj0XYtF 1UdFrvaFaxfHMszhWnCyU/M+M295g4WS8kvpyOK2OAYA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a stale msc->input if no input is claimed magicmouse_input_mapping() caches the first hid_input's input_dev in msc->input while the report descriptor is parsed, and the rest of the driver treats a non-NULL msc->input as proof that an input device was registered. That does not hold on the hid-input error path. If hidinput_connect() fails -- for instance because input_register_device() returns an error -- it unwinds through hidinput_disconnect(), which frees every input_dev it created, including the one cached in msc->input. The failure does not abort the probe. hid_connect() only skips the claim: if ((connect_mask & HID_CONNECT_HIDINPUT) && !hidinput_connect(hdev, connect_mask & HID_CONNECT_HIDINPUT_FORCE)) hdev->claimed |= HID_CLAIMED_INPUT; and the "device has no listeners" bailout below it does not fire for this driver, which sets ->raw_event; on the USB Magic Mouse 2 / Magic Trackpad 2 paths hidraw and hiddev are claimed as well. hid_hw_start() therefore returns 0 and magicmouse_probe() continues with msc->input pointing at freed memory. Being non-NULL, it passes the "input not registered" check in probe and the NULL checks in ->raw_event and ->event, so the next input report dereferences freed memory. Clear msc->input when the HID core did not claim an input device, so the existing NULL checks cover this case as well. The Linux kernel CVE team has assigned CVE-2026-80782 to this issue. Affected and fixed versions =========================== Issue introduced in 3.9 with commit f1a9a149abc86903e81dd1b2e720f3f89874384b and fixed in 5.10.269 with commit c3597923932bb90d4fc2186aef552f6677175e4a Issue introduced in 3.9 with commit f1a9a149abc86903e81dd1b2e720f3f89874384b and fixed in 5.15.218 with commit e0c224c93d10ee38854fdf24c815108aedd3dcb3 Issue introduced in 3.9 with commit f1a9a149abc86903e81dd1b2e720f3f89874384b and fixed in 6.1.185 with commit 403cc9bd6ccb9fbe68d501c3236e5a6dd5504e14 Issue introduced in 3.9 with commit f1a9a149abc86903e81dd1b2e720f3f89874384b and fixed in 6.6.154 with commit 3d7a7bac4c75f25b2513505a0ac5ba909588ed2b Issue introduced in 3.9 with commit f1a9a149abc86903e81dd1b2e720f3f89874384b and fixed in 6.12.106 with commit 9bdf8c7bfd79f1090e61d28f969b32880fd77bb3 Issue introduced in 3.9 with commit f1a9a149abc86903e81dd1b2e720f3f89874384b and fixed in 6.18.47 with commit 15b60ade825c8ce9ec560048a4ae3747e4572be3 Issue introduced in 3.9 with commit f1a9a149abc86903e81dd1b2e720f3f89874384b and fixed in 7.1.11 with commit 0bf253e9ac994cb5329bc87b00bb4eeca9136791 Issue introduced in 3.9 with commit f1a9a149abc86903e81dd1b2e720f3f89874384b and fixed in 7.2.1 with commit 2ef16934e069d5f771e989d6ee5c3ece5042f3cd Issue introduced in 3.9 with commit f1a9a149abc86903e81dd1b2e720f3f89874384b and fixed in 7.3-rc1 with commit 0af3b89705688af01aa06025b84fa7a1e06ba6cc Issue introduced in 3.8.7 with commit 0e55072e7c63a6569cab1447e9025d160abd9dd9 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-80782 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/hid/hid-magicmouse.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c3597923932bb90d4fc2186aef552f6677175e4a https://git.kernel.org/stable/c/e0c224c93d10ee38854fdf24c815108aedd3dcb3 https://git.kernel.org/stable/c/403cc9bd6ccb9fbe68d501c3236e5a6dd5504e14 https://git.kernel.org/stable/c/3d7a7bac4c75f25b2513505a0ac5ba909588ed2b https://git.kernel.org/stable/c/9bdf8c7bfd79f1090e61d28f969b32880fd77bb3 https://git.kernel.org/stable/c/15b60ade825c8ce9ec560048a4ae3747e4572be3 https://git.kernel.org/stable/c/0bf253e9ac994cb5329bc87b00bb4eeca9136791 https://git.kernel.org/stable/c/2ef16934e069d5f771e989d6ee5c3ece5042f3cd https://git.kernel.org/stable/c/0af3b89705688af01aa06025b84fa7a1e06ba6cc