CVE-2026-80769: Linux Kernel HID Privilege Escalation

CVE-2026-80769 Overview

CVE-2026-80769 is a Linux kernel vulnerability in the HID (Human Interface Device) subsystem's Rapoo driver. The driver calls to_usb_interface() on a hid_device without first verifying the device is actually attached to a USB bus. The uhid subsystem allows userspace to create devices that report BUS_USB without having a real USB parent, letting an unprivileged user trigger the invalid cast.

The issue was confirmed to produce a kernel splat in ASAN-instrumented builds. Upstream commits resolve the flaw by adding a hid_is_usb() check and declaring a USB_HID build dependency.

Critical Impact
A local unprivileged user can trigger a kernel memory-safety violation through the uhid interface, leading to denial of service on affected Linux kernels.

Affected Products

Linux kernel — HID Rapoo driver (drivers/hid/hid-rapoo.c)
Kernel builds where CONFIG_HID_RAPOO is enabled without CONFIG_USB_HID
Distributions shipping vulnerable kernel versions prior to the fix commits

Discovery Timeline

2026-09-04 - CVE-2026-80769 published to the National Vulnerability Database (NVD)
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80769

Vulnerability Analysis

The Rapoo HID driver invokes to_usb_interface() on the parent of a hid_device on the assumption that the parent is a struct usb_interface. This assumption fails when a device is created via uhid, the userspace HID transport that lets any process register a virtual HID device and choose its bus identifier.

By creating a virtual device that advertises BUS_USB with a Rapoo vendor and product identifier, an attacker forces the kernel to bind the Rapoo driver. The subsequent to_usb_interface() cast then reinterprets a non-USB parent structure as a USB interface, producing out-of-bounds accesses that ASAN detects as a kernel splat.

This pattern has appeared repeatedly across HID drivers, and the fix mirrors the standard remediation used elsewhere in the subsystem.

Root Cause

The root cause is a missing type check before performing a container-of style cast. The driver treats a bus identifier field as authoritative evidence of the underlying transport, which is untrusted because uhid lets userspace populate that field freely. Without a hid_is_usb() guard, the driver dereferences memory that does not conform to the expected usb_interface layout.

Attack Vector

Exploitation requires local access and the ability to open /dev/uhid. On many distributions this device is available to unprivileged users through session policies. The attacker registers a virtual HID device with BUS_USB and a Rapoo vendor/product identifier, then lets the kernel probe the driver. See the upstream fix commits 49b6fd2, 99ed3fe, and b57af24 for technical details of the corrected probe path.

Detection Methods for CVE-2026-80769

Indicators of Compromise

Kernel oops or panic messages referencing hid-rapoo in the call stack
KASAN or ASAN reports flagging invalid access originating from to_usb_interface() inside the Rapoo probe path
Unexpected creation of uhid devices reporting Rapoo vendor identifiers on systems without physical Rapoo peripherals

Detection Strategies

Audit kernel version and the CONFIG_HID_RAPOO build flag across the fleet to identify exposed hosts
Monitor dmesg and journal logs for splats or warnings referencing hid_rapoo, to_usb_interface, or KASAN reports
Alert on processes opening /dev/uhid that are not part of an approved allowlist such as Bluetooth or virtualization stacks

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging pipeline for anomaly review
Track loading of hid-rapoo on systems that have no attached Rapoo hardware
Correlate /dev/uhid access with process lineage to identify unexpected local exploitation attempts

How to Mitigate CVE-2026-80769

Immediate Actions Required

Apply the upstream kernel patch or update to a distribution kernel that includes commits 49b6fd2, 99ed3fe, and b57af24
If patching is delayed, unload or blacklist the hid-rapoo module on systems that do not use Rapoo peripherals
Restrict access to /dev/uhid to trusted service accounts through udev rules or seccomp policy

Patch Information

The fix adds a hid_is_usb() check before calling to_usb_interface() in the Rapoo driver and declares a build dependency on USB_HID. Vendors backporting the change should pick all three referenced commits to preserve the dependency and the guard together. Track distribution advisories from Debian, Ubuntu, Red Hat, and SUSE for backport availability.

Workarounds

Blacklist the driver by adding blacklist hid_rapoo to /etc/modprobe.d/ and rebuilding the initramfs
Remove read/write permissions on /dev/uhid for unprivileged users via a udev rule
Disable CONFIG_HID_RAPOO in custom kernel builds where Rapoo peripherals are not required

bash

# Configuration example
echo 'blacklist hid_rapoo' | sudo tee /etc/modprobe.d/blacklist-hid-rapoo.conf
sudo depmod -a
sudo update-initramfs -u

# Restrict /dev/uhid to root only
echo 'KERNEL=="uhid", MODE="0600", OWNER="root", GROUP="root"' | \
  sudo tee /etc/udev/rules.d/90-uhid-restrict.rules
sudo udevadm control --reload-rules