CVE-2026-80773 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should assess exposure and verify the presence of the fix in their kernel versions. They should review Linux kernel versions for the presence of the fix, verify that the hid_is_usb() check is properly used in the HID: huawei module, and update the kernel to a version that includes the resolving commit if necessary. Additionally, they should confirm whether affected product deployments exist in managed to

Why it matters

A vulnerability in the Linux kernel's HID: huawei module can cause a kernel splat if not properly handled. Maintainers and users should verify the presence of the fix in their kernel versions.

• Verification of kernel versions and updates is necessary to prevent potential kernel splats
• Linux kernel maintainers and users must ensure the hid_is_usb() check is properly used in the HID: huawei module

Technical summary

The Linux kernel's HID: huawei module is vulnerable to a kernel splat due to improper use of the to_usb_interface() function without a hid_is_usb() check. A fix has been implemented by adding a hid_is_usb() check. This ensures that the to_usb_interface() function is only used on HID devices with a USB parent, preventing potential kernel splats. The fix has been committed to the Linux kernel and is available in updated kernel versions. Maintainers and users should verify the presence of this fix in their kernel versions.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify the presence of the fix in their kernel versions.

Recommended defensive actions

• Review Linux kernel versions for the presence of the fix
• Verify that the hid_is_usb() check is properly used in the HID: huawei module
• Update kernel to a version that includes the resolving commit if necessary
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and references to the resolving commits. The resolving commits are 4cdb6b4b, 66805454, and 9acc2463. These commits address the issue by adding a hid_is_usb() check before using to_usb_interface(). The CVE record was published on 2026-09-04T16:18:02.890Z and has not been modified since then. The NVD entry provides additional information on the vulnerability, including its CVSS score and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.