CVE-2026-43140: Linux Kernel HID Magicmouse DOS Flaw

CVE-2026-43140 Overview

CVE-2026-43140 is a NULL pointer dereference vulnerability in the Linux kernel's HID magicmouse driver. The flaw resides in how the driver handles devices that impersonate an Apple Magic Mouse over USB. When a fake USB device sends a custom report descriptor, the input_mapping() hook is bypassed, leaving the msc->input pointer as NULL. Subsequent driver code dereferences this pointer, triggering a kernel crash. The fix detects this condition inside the input_configured() hook and rejects the device before the unsafe dereference occurs.

Critical Impact
A malicious or malformed USB device imposing as a Magic Mouse can crash the Linux kernel through a NULL pointer dereference, resulting in a local denial-of-service condition.

Affected Products

Linux kernel — HID magicmouse driver
Multiple stable branches receiving backported fixes (see kernel.org commits)
Systems exposing USB ports to untrusted physical or virtual devices

Discovery Timeline

2026-05-06 - CVE CVE-2026-43140 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43140

Vulnerability Analysis

The Linux kernel HID subsystem dispatches several driver callbacks during USB device enumeration, including input_mapping() and input_configured(). The magicmouse driver relies on input_mapping() to populate the msc->input field with a valid struct input_dev pointer. Genuine Apple Magic Mouse hardware always triggers this code path because its report descriptor matches the expected layout.

A rogue USB device can advertise the Magic Mouse vendor and product IDs while supplying an arbitrary report descriptor. When the descriptor does not match the patterns the driver expects, the kernel never invokes input_mapping(). The driver then proceeds with msc->input still set to NULL. Later operations dereference this pointer and crash the kernel with an oops or panic.

This class of issue falls under Null Pointer Dereference [CWE-476] and represents a denial-of-service condition reachable from anyone capable of attaching a USB device, including virtualized or emulated USB stacks.

Root Cause

The magicmouse driver assumed that input_mapping() would always run before input_configured() for any device claiming to be a Magic Mouse. This assumption breaks when a device supplies a non-standard HID report descriptor. The driver did not validate msc->input before using it, exposing a reachable NULL dereference path.

Attack Vector

Exploitation requires the ability to present a USB device, whether physically through an exposed USB port or virtually via USB-over-IP, a malicious USB gadget, or a compromised hypervisor passing through emulated USB hardware. The attacker crafts a device that reports the Apple vendor and product identifiers associated with the Magic Mouse but ships a custom HID report descriptor. Once the kernel binds the magicmouse driver to the device, the call sequence reaches the unguarded dereference and crashes the host.

The vulnerability does not yield code execution or privilege escalation. The impact is limited to availability through kernel panic or oops on the affected machine.

No verified exploit code is publicly available. The technical fix is documented across multiple stable kernel commits referenced in the kernel.org git tree.

Detection Methods for CVE-2026-43140

Indicators of Compromise

Kernel oops or panic messages referencing the magicmouse module and a NULL pointer dereference in dmesg or /var/log/kern.log.
USB enumeration events for devices reporting Apple vendor IDs from systems that should not have Magic Mouse hardware attached.
Repeated unexpected reboots correlated with USB hotplug activity.

Detection Strategies

Monitor kernel ring buffer output for BUG: kernel NULL pointer dereference entries containing magicmouse symbols in the call trace.
Audit USB device connection events through udev, auditd, or usbguard logs and alert on unrecognized HID devices claiming Apple identifiers.
Track host availability metrics for unplanned kernel crashes that coincide with USB device insertion timestamps.

Monitoring Recommendations

Forward kernel logs and USB audit events to a centralized logging or SIEM platform for correlation across the fleet.
Baseline expected USB peripherals on each host and alert on deviations, particularly on servers and kiosks.
Inspect virtualization platforms for guest-controlled USB passthrough configurations that could deliver crafted HID descriptors to the host.

How to Mitigate CVE-2026-43140

Immediate Actions Required

Apply the kernel updates from your distribution that incorporate the upstream fix referenced in the kernel.org commits, such as commit 165912d4 and commit 5bbe2662.
Restrict physical access to USB ports on servers, workstations, and shared kiosks.
Disable USB passthrough for untrusted virtual machines until hosts are patched.

Patch Information

The upstream fix adds a NULL check inside the input_configured() hook of the magicmouse driver. When msc->input is NULL, the driver rejects the device and returns an error rather than continuing with an invalid pointer. Stable backports are published in the kernel.org commits listed in the references, including 165912d4, 17abd396, 243e1165, 36c83c13, 5bbe2662, 922bd3e4, db5ba06e, and f6a38602. Apply the vendor kernel package that includes these commits for your distribution branch.

Workarounds

Blacklist the hid_magicmouse kernel module on systems that do not require Magic Mouse support using a modprobe configuration entry.
Deploy USBGuard or equivalent USB authorization policies to allow only known device IDs.
Disable unused USB controllers in firmware on systems that do not need USB peripherals.

bash

# Blacklist the magicmouse driver until patches are applied
echo "blacklist hid_magicmouse" | sudo tee /etc/modprobe.d/blacklist-magicmouse.conf
sudo rmmod hid_magicmouse 2>/dev/null || true
sudo update-initramfs -u