CVE-2026-80765: Linux Kernel Hyper-V HID DOS Vulnerability

CVE-2026-80765 Overview

CVE-2026-80765 is an out-of-bounds read vulnerability in the Linux kernel's Hyper-V synthetic HID driver (hid-hyperv). The mousevsc_on_receive_device_info() function processes SYNTH_HID_INITIAL_DEVICE_INFO messages that contain a HID descriptor followed by report descriptor bytes. The driver trusts the bLength and wDescriptorLength fields from the host without validating that the received VMBus packet actually contains both byte ranges.

A malicious Hyper-V host or backend can send a short initial device-info message with an oversized HID report descriptor length, causing the guest kernel to read past the end of the received VMBus packet.

Critical Impact
A malicious Hyper-V host or backend can crash a Linux guest by sending a malformed initial device-info message containing an inflated HID report descriptor length.

Affected Products

Linux kernel with hid-hyperv driver enabled (CONFIG_HID_HYPERV_MOUSE)
Linux guest virtual machines running on Microsoft Hyper-V
Multiple stable kernel branches (see referenced upstream commits for fixed versions)

Discovery Timeline

2026-09-04 - CVE-2026-80765 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80765

Vulnerability Analysis

The vulnerability resides in the Hyper-V synthetic HID mouse driver located in drivers/hid/hid-hyperv.c. When a VMBus channel delivers a SYNTH_HID_INITIAL_DEVICE_INFO message, the guest driver parses the payload as a HID descriptor followed by a variable-length report descriptor. The parser reads the bLength field from the HID descriptor header and the wDescriptorLength field that indicates the size of the report descriptor that follows.

Before the fix, mousevsc_on_receive_device_info() copied wDescriptorLength bytes from the packet buffer without confirming that the received packet actually contained that many bytes after the HID descriptor. When the attacker-controlled length exceeded the true packet size, the kernel dereferenced memory beyond the VMBus receive buffer, resulting in an out-of-bounds read [CWE-125] and a subsequent guest kernel crash.

Root Cause

The root cause is missing input validation on host-supplied length fields. The driver trusted the untrusted producer (the Hyper-V host or backend) to supply consistent header values matching the actual packet length. The upstream fix passes the received initial-device-info size into the parser and rejects descriptor lengths that exceed the packet boundary.

Attack Vector

Exploitation requires the ability to send synthetic HID messages over a VMBus channel to a Linux guest. This corresponds to a malicious or compromised Hyper-V host, a compromised virtualization backend, or a scenario where an attacker controls the hypervisor-side component servicing the guest's synthetic mouse device. The attack breaks the standard trust boundary in which the host is assumed benign; it is relevant to nested virtualization, hostile cloud host scenarios, and confidential computing threat models where guest kernel integrity must be preserved against a compromised host component.

The vulnerability is a memory-safety issue affecting confidentiality of adjacent guest kernel memory read during the copy and availability of the guest through a kernel crash. See the upstream commit c894143c and related backports for technical details.

Detection Methods for CVE-2026-80765

Indicators of Compromise

Unexpected Linux guest kernel oops or panic messages referencing hid-hyperv, mousevsc_on_receive_device_info, or VMBus channel callbacks.
KASAN reports (on instrumented kernels) flagging an out-of-bounds read within the Hyper-V HID receive path.
Repeated guest reboots or synthetic HID device initialization failures shortly after VM start or device hotplug.

Detection Strategies

Monitor guest dmesg and journalctl -k output for kernel warnings, oops, or panic entries involving hid_hyperv or hv_vmbus.
Enable KASAN in test and canary kernels to catch out-of-bounds accesses during Hyper-V integration testing.
Track Linux kernel package versions across the fleet and flag hosts running kernels older than the branch-specific fixed versions listed in the referenced stable commits.

Monitoring Recommendations

Forward guest kernel logs to a centralized logging platform and alert on repeated hid-hyperv faults or VMBus channel resets.
Track hypervisor host integrity and access controls; a compromised host is the prerequisite for exploitation.
Review virtualization audit trails for unauthorized changes to VMBus backend components or synthetic device emulation code paths.

How to Mitigate CVE-2026-80765

Immediate Actions Required

Update Linux guest kernels to a version that includes the upstream fix from one of the referenced stable commits (for example, commit 334271d3 or commit c894143c).
Prioritize patching Linux VMs running on multi-tenant or untrusted Hyper-V hosts, including nested virtualization environments.
Verify hypervisor host integrity and restrict administrative access to Hyper-V management interfaces.

Patch Information

The fix modifies mousevsc_on_receive_device_info() in drivers/hid/hid-hyperv.c to pass the received initial-device-info packet size into the descriptor parser and reject wDescriptorLength values that exceed the packet. Backports are available across multiple stable branches. See the full list of upstream commits: 25297377, 334271d3, 390d3d9c, 608f8fd8, 8614c043, 934b7778, c894143c, e0d5d3e4, and f84d7775.

Workarounds

If patching is not immediately possible and the synthetic mouse is not required, unload or blacklist the hid_hyperv module in guest VMs to eliminate the vulnerable code path.
Enforce strict isolation and integrity controls on Hyper-V hosts to reduce the likelihood that a compromised host can reach guest VMBus channels.
Restrict which workloads run on hosts of unknown integrity; treat host compromise as the exploitation precondition and plan compensating controls accordingly.