CVE-2026-80780 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users who need to ensure the security of their Linux kernel installations should be aware of this vulnerability. They should assess exposure, verify patch deployment, and implement compensating controls to detect and prevent exploitation. Security teams and vulnerability management teams should also prioritize patching and monitoring for this issue.

Why it matters

CVE-2026-80780 is a Linux kernel vulnerability that allows for an out-of-bounds write when HID inputs are empty. The issue arises in the hid_pidff_init_with_quirks function, which does not check if hid->inputs is empty before accessing its members. This can lead to a type-confused pointer and writes past the end of the object. The vulnerability can be triggered by plugging in a malicious device, requiring no attacker software or logged-in user. Defenders should assess exposure of Linux kernel installations to this vulnerability, verify patch deployment, implement compensating controls, and monitor system logs for suspicious activity.

• Verify patch deployment to prevent out-of-bounds writes
• Assess exposure of Linux kernel installations to this vulnerability
• Implement compensating controls to detect and prevent exploitation
• Monitor system logs for suspicious activity

Technical summary

The hid_pidff_init_with_quirks function in the Linux kernel does not check if hid->inputs is empty before accessing its members, leading to a type-confused pointer and writes past the end of the object. This issue allows for an out-of-bounds write when HID inputs are empty. The vulnerability can be triggered by plugging in a malicious device, requiring no attacker software or logged-in user. The fix involves checking for an empty list before deriving dev and returning -ENODEV, similar to other HID force-feedback drivers.

Defensive priority

High

Recommended defensive actions

• Assess exposure of Linux kernel installations to this vulnerability
• Verify that all Linux kernel versions in use have been patched
• Implement compensating controls to detect and prevent exploitation
• Monitor system logs for suspicious activity
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability was discovered by XBOW and triaged by Baul Lee. The issue is resolved by checking for an empty list before deriving dev and returning -ENODEV. Limited source detail is available; defenders should verify patch deployment, assess exposure of Linux kernel installations, and monitor system logs for suspicious activity with explicit evidence-limit language.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.