CVE-2026-80782

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: magicmouse: do not keep a stale msc->input if no input is claimed

magicmouse_input_mapping() caches the first hid_input's input_dev in

msc->input while the report descriptor is parsed, and the rest of the

driver treats a non-NULL msc->input as proof that an input device was

registered.

That does not hold on the hid-input error path. If hidinput_connect()

fails -- for instance because input_register_device() returns an error --

it unwinds through hidinput_disconnect(), which frees every input_dev it

created, including the one cached in msc->input.

The failure does not abort the probe. hid_connect() only skips the claim:

if ((connect_mask & HID_CONNECT_HIDINPUT) && !hidinput_connect(hdev,

connect_mask & HID_CONNECT_HIDINPUT_FORCE))

hdev->claimed |= HID_CLAIMED_INPUT;

and the "device has no listeners" bailout below it does not fire for this

driver, which sets ->raw_event; on the USB Magic Mouse 2 / Magic

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References