CVE-2026-80773: Linux Kernel HID Privilege Escalation Flaw

CVE-2026-80773 is a privilege escalation vulnerability in the Linux kernel HID subsystem affecting USB device handling. The flaw enables potential unauthorized access through improper interface checks. This article covers technical details, affected kernel versions, security impact, and available mitigation strategies.

CVE-2026-80773 Overview

CVE-2026-80773 addresses a flaw in the Linux kernel's HID (Human Interface Device) subsystem, specifically in the Huawei driver. The driver calls to_usb_interface() on a hid_device without first verifying the transport bus with hid_is_usb(). The uhid interface allows userspace to create virtual HID devices that report BUS_USB without an actual USB parent. Invoking to_usb_interface() on such a device produces an invalid pointer dereference, triggering a kernel splat confirmed under an ASAN build.

Critical Impact
Local unprivileged users capable of creating uhid devices can trigger kernel memory access violations in the Huawei HID driver, leading to denial-of-service conditions.

Affected Products

Linux kernel HID subsystem (drivers/hid/hid-huawei.c)
Kernel builds exposing uhid (/dev/uhid) to userspace
Kernel versions prior to the commits referenced in the stable trees

Discovery Timeline

2026-09-04 - CVE-2026-80773 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80773

Vulnerability Analysis

The Huawei HID driver assumes every hid_device it binds to sits on a USB transport. It calls to_usb_interface(hdev->dev.parent) to reach the USB interface structure. This assumption holds for genuine USB devices but breaks when the device originates from uhid. The uhid facility lets userspace synthesize HID devices and declare an arbitrary bus type, including BUS_USB, without a real USB parent in the device tree.

When the Huawei driver casts the non-USB parent pointer as a struct usb_interface, subsequent field accesses dereference unrelated memory. The result is a kernel-mode fault classifiable as a type confusion leading to out-of-bounds read behavior. The reporter confirmed a reproducible kernel splat in an AddressSanitizer (KASAN) build.

Root Cause

The driver omits the hid_is_usb(hdev) guard that other HID drivers use before invoking to_usb_interface(). Without this check, the bus-type field on the hid_device is trusted implicitly, even though uhid permits userspace to control it. The fix inserts the hid_is_usb() check so the driver aborts probe or callback paths when the underlying transport is not USB.

Attack Vector

Exploitation requires local access and the ability to open /dev/uhid, which on many distributions is restricted to root or specific groups. An attacker with that access crafts a uhid device advertising BUS_USB and a Huawei vendor and product identifier that the driver matches. Probe then invokes the vulnerable code path and faults. The impact is limited to a denial-of-service outcome; there is no evidence of code execution in the referenced fix.

The vulnerability manifests in the Huawei HID driver's probe and report handlers. Refer to the upstream commit at git.kernel.org/stable/c/9acc2463991cdb0856fdbd63fd7178102c1ed73d for the exact source-level change.

Detection Methods for CVE-2026-80773

Indicators of Compromise

Kernel oops or panic messages referencing hid-huawei, to_usb_interface, or usb_ifnum_to_if
KASAN reports flagging invalid reads within the Huawei HID probe path
Unexpected loading of hid_huawei in response to virtual HID device creation events

Detection Strategies

Monitor dmesg and journalctl -k for repeated HID subsystem faults correlated with uhid activity
Audit userspace processes opening /dev/uhid and inspect the device descriptors they submit
Correlate kernel crash dumps with process lineage to identify the invoking binary and user

Monitoring Recommendations

Enable auditd rules on /dev/uhid open and ioctl operations
Ship kernel ring buffer logs to a central SIEM for anomaly detection on HID subsystem faults
Track kernel package versions across the fleet to identify hosts still running vulnerable builds

How to Mitigate CVE-2026-80773

Immediate Actions Required

Apply the upstream stable-tree commits 4cdb6b4b34d7, 66805454c01f, and 9acc2463991c or update to a distribution kernel that includes them
Restrict access to /dev/uhid to trusted administrative accounts only
Reboot affected systems after patch installation to load the fixed kernel image

Patch Information

The fix adds a hid_is_usb() check before calling to_usb_interface() in the Huawei HID driver. It is available in the mainline and stable kernel trees at the commits listed in the kernel.org stable commit 9acc2463, commit 66805454, and commit 4cdb6b4b. Consume the fix through your distribution's kernel security updates.

Workarounds

Blacklist the hid_huawei module on hosts that do not require Huawei HID device support
Remove or tighten permissions on /dev/uhid using udev rules to prevent unprivileged access
Disable CONFIG_UHID in custom kernel builds where the facility is not required

bash

# Blacklist the hid-huawei module
echo "blacklist hid_huawei" | sudo tee /etc/modprobe.d/blacklist-hid-huawei.conf
sudo depmod -a

# Restrict /dev/uhid access via udev
echo 'KERNEL=="uhid", MODE="0600", OWNER="root"' | \
  sudo tee /etc/udev/rules.d/90-uhid-restrict.rules
sudo udevadm control --reload-rules