CVE-2026-80782 Overview
CVE-2026-80782 is a use-after-free vulnerability in the Linux kernel's hid-magicmouse driver. The flaw exists in magicmouse_input_mapping(), which caches the first hid_input's input_dev in msc->input during report descriptor parsing. When hidinput_connect() fails, the kernel frees the cached input device but does not clear the pointer. Subsequent input reports dereference freed memory through ->raw_event and ->event callbacks. The vulnerability affects systems using Apple Magic Mouse 2 and Magic Trackpad 2 devices over USB.
Critical Impact
Freed kernel memory is dereferenced on the next input report, enabling potential kernel memory corruption when an input device registration fails during probe.
Affected Products
- Linux kernel hid-magicmouse driver
- Systems with Apple Magic Mouse 2 devices
- Systems with Apple Magic Trackpad 2 devices
Discovery Timeline
- 2026-09-04 - CVE-2026-80782 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80782
Vulnerability Analysis
The hid-magicmouse driver caches a pointer to the first hid_input's input_dev in msc->input while parsing the report descriptor. The remainder of the driver treats a non-NULL msc->input as evidence that an input device was successfully registered. This assumption breaks on the hid-input error path.
When hidinput_connect() fails, for example because input_register_device() returns an error, it unwinds through hidinput_disconnect(). That cleanup frees every input_dev it created, including the one cached in msc->input. The pointer remains stale but non-NULL.
Root Cause
The probe function does not abort on the connect failure. hid_connect() only skips setting the HID_CLAIMED_INPUT flag. The "device has no listeners" bailout does not fire because the driver implements ->raw_event, and on USB Magic Mouse 2 / Magic Trackpad 2 paths, hidraw and hiddev are still claimed. hid_hw_start() returns 0 and magicmouse_probe() continues with msc->input pointing at freed memory.
Attack Vector
Because msc->input remains non-NULL, it passes the "input not registered" check in probe and the NULL checks in ->raw_event and ->event. The next input report dereferences freed kernel memory, producing a use-after-free condition. Exploitation requires triggering the hidinput_connect() failure path during device probe, which typically requires local access or a malicious or malfunctioning HID device.
The fix clears msc->input when the HID core did not claim an input device, so the existing NULL checks correctly cover this failure case. See the upstream commit for the patch details.
Detection Methods for CVE-2026-80782
Indicators of Compromise
- Kernel oops or panic messages referencing magicmouse_raw_event or magicmouse_event after HID device enumeration
- KASAN reports flagging use-after-free in the hid-magicmouse code path
- Unexpected input subsystem registration failures in dmesg preceding driver instability
Detection Strategies
- Enable CONFIG_KASAN in test and staging kernels to catch the use-after-free at the moment of dereference
- Audit running kernel versions against the fixed stable branches listed in the kernel.org commits
- Monitor dmesg for hidinput_connect errors correlated with subsequent HID driver faults
Monitoring Recommendations
- Collect kernel logs centrally and alert on BUG: KASAN or general protection fault entries referencing HID drivers
- Track kernel package versions across the fleet to identify hosts still running vulnerable builds
- Review USB device connection events on servers and workstations that expose USB ports to untrusted users
How to Mitigate CVE-2026-80782
Immediate Actions Required
- Apply the upstream Linux kernel patch that clears msc->input when the HID core does not claim an input device
- Update to a distribution kernel package that incorporates the fix once available from your vendor
- Restrict physical and USB access on systems where Apple Magic Mouse 2 or Magic Trackpad 2 devices are not required
Patch Information
The fix has been merged across multiple stable branches. Reference commits include c3597923, 0af3b897, 0bf253e9, 15b60ade, 2ef16934, 3d7a7bac, 403cc9bd, 9bdf8c7b, and e0c224c9.
Workarounds
- Blacklist the hid_magicmouse module on systems that do not use Apple Magic Mouse 2 or Magic Trackpad 2 hardware
- Enforce USB device allowlisting through udev rules or endpoint controls to block unauthorized HID devices
- Limit local user access to systems where the driver is loaded until patches are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.