CVE-2026-80783 Linux CVE debrief

Who should care

Defenders responsible for Linux-based systems, especially those with externally connected or untrusted HID devices, should assess exposure to this vulnerability. This includes administrators of Linux desktops, servers, and embedded systems that use the affected driver. Security teams should verify patch deployment and monitor for suspicious activity.

Why it matters

This vulnerability in the Linux kernel's HID magicmouse driver can lead to a stack overflow due to unbounded recursion when handling specially crafted HID reports. Defenders should prioritize patching affected systems, particularly those exposed to untrusted HID devices, and monitor for signs of exploitation.

• Verify patch deployment to prevent potential stack overflows.
• Monitor system logs for signs of stack overflows or similar errors.
• Restrict access to HID devices to trusted sources.
• Implement additional monitoring for suspicious HID device activity.

Technical summary

The Linux kernel's HID magicmouse driver is vulnerable to a stack overflow due to unbounded recursion in the magicmouse_raw_event() function when handling DOUBLE_REPORT_ID packets. This can be exploited by a malicious HID device to cause a stack overflow, potentially leading to a system panic or memory corruption. The issue has been fixed by adding a check to prevent excessive recursion. Affected systems include Linux desktops, servers, and embedded systems that use the affected driver and have untrusted or externally connected HID devices. Defenders should prioritize verifying and applying patches, monitoring system logs for signs of stack overflows, and restricting access to HID devices to trusted sources.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly for systems with untrusted or externally connected HID devices. They should also monitor system logs for signs of stack overflows or similar errors.

Recommended defensive actions

• Verify and apply patches for Linux kernel versions affected by this vulnerability.
• Monitor system logs for signs of stack overflows or similar errors.
• Restrict access to HID devices to trusted sources.
• Implement additional monitoring for suspicious HID device activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and associated references provide details on the vulnerability, its impact, and the fix. However, specific version ranges of the Linux kernel affected by this issue are not provided in the supplied data, requiring further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.