CVE-2026-80782 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, users of Linux systems with the HID magicmouse driver, security teams, and operators managing Linux-based infrastructure should assess exposure and apply patches to prevent potential system crashes or arbitrary code execution.

Why it matters

A vulnerability in the Linux kernel's HID magicmouse driver can cause a use-after-free condition, potentially leading to system crashes or arbitrary code execution. Linux kernel developers, maintainers, and users of Linux systems with the HID magicmouse driver should assess exposure and apply patches.

• Potential system crashes or instability
• Possible arbitrary code execution if an attacker can trigger the vulnerability
• Need to verify and apply kernel patches to fix the vulnerability

Technical summary

The Linux kernel's HID magicmouse driver does not properly handle the case where `hidinput_connect` fails. When this happens, `hidinput_disconnect` frees the input device, but the driver still holds a pointer to the freed memory. This can cause a use-after-free condition when the driver tries to access the input device later. The vulnerability can lead to system crashes or potentially allow an attacker to execute arbitrary code if they can trigger the specific conditions. Affected Linux kernel developers and maintainers should assess exposure and apply patches.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided kernel patches to fix the vulnerability
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor system logs for potential crashes or errors related to the HID magicmouse driver
• Verify that the Linux kernel patch is compatible with existing system configurations
• Check for any additional vendor guidance or advisories related to this vulnerability
• Perform a thorough review of system exposure and potential impacts
• Track and document the remediation process for future reference

Evidence notes

The Linux kernel's HID magicmouse driver does not properly handle the case where `hidinput_connect` fails. When this happens, `hidinput_disconnect` frees the input device, but the driver still holds a pointer to the freed memory. This can cause a use-after-free condition when the driver tries to access the input device later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.