CVE-2026-80783: Linux Kernel HID Buffer Overflow Vulnerability

CVE-2026-80783 Overview

CVE-2026-80783 is a stack overflow vulnerability in the Linux kernel's HID magicmouse driver. The flaw resides in magicmouse_raw_event(), which processes DOUBLE_REPORT_ID (0xf7) packets by splitting them and recursively invoking itself on each half. The only safeguard is a size < 1 check, which prevents zero-sized calls but fails to bound recursion depth. A malicious HID device matching this driver can send a crafted report that triggers roughly 8000 nested calls, exhausting the 16 KiB kernel stack.

Critical Impact
A malicious USB or Bluetooth HID device matching the magicmouse driver can trigger a kernel stack overflow, causing a panic with CONFIG_VMAP_STACK or arbitrary memory corruption without it.

Affected Products

Linux kernel versions containing the vulnerable drivers/hid/hid-magicmouse.c recursion path
Systems with the hid-magicmouse module loaded and physical or wireless HID input available
Distributions shipping kernels prior to the fixes referenced in the upstream stable commits

Discovery Timeline

2026-09-04 - CVE-2026-80783 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80783

Vulnerability Analysis

The vulnerability is an unbounded recursion flaw in the Linux kernel HID subsystem, specifically in the Apple Magic Mouse driver. The function magicmouse_raw_event() is designed to handle DOUBLE_REPORT_ID (0xf7) packets, a legitimate encoding used by the device to pack two touch reports into a single HID report. The driver splits the packet in half and recursively calls itself on each portion to reuse the standard parsing path.

The implementation includes only a minimal size < 1 guard, which rejects zero-length calls but places no limit on recursion depth. Because HID input can originate from any device that matches the driver's device ID, an attacker controlling such a device can supply crafted report contents that repeatedly re-enter the recursive branch.

A single incoming report of up to HID_MAX_BUFFER_SIZE (16 KiB) can drive approximately 8000 nested frames, exhausting the kernel stack. The result is a stack overflow that produces a kernel panic on systems built with CONFIG_VMAP_STACK, and memory corruption on systems built without it.

Root Cause

The root cause is missing recursion-depth enforcement in magicmouse_raw_event(). The DOUBLE_REPORT_ID case wraps two normal reports and is never legitimately nested, yet the code permits 0xf7 packets to be processed recursively from within an already-recursive invocation. The upstream fix refuses to re-enter the DOUBLE_REPORT_ID branch from a recursive call, bounding the depth to two while preserving parsing of all valid packets.

Attack Vector

Exploitation requires a HID device that matches the magicmouse driver. An attacker with physical access can attach a malicious USB device, or a device that spoofs Apple Magic Mouse USB identifiers over Bluetooth. Once bound, the device sends a report beginning with 0xf7 and filled with the repeating sequence [0xf7, 0x00]. Each recursion level consumes two bytes and recurses on the remainder, driving stack exhaustion inside kernel context. The vulnerability is classified as a denial-of-service primitive at minimum, with potential for memory corruption depending on kernel configuration.

Refer to the upstream fix commits for the exact code changes: Linux Kernel Commit 26c45ab, Linux Kernel Commit d16df75, and Linux Kernel Commit db8d634.

Detection Methods for CVE-2026-80783

Indicators of Compromise

Kernel panic messages referencing magicmouse_raw_event in the call trace, particularly with deeply nested frames on CONFIG_VMAP_STACK systems
dmesg entries showing HID device binding to hid-magicmouse immediately followed by kernel oops or stack guard-page faults
Sudden system reboots or hangs correlated with USB or Bluetooth HID device attachment events

Detection Strategies

Audit loaded kernel modules for hid_magicmouse on systems that do not require Apple Magic Mouse support and flag its presence for review
Monitor udev and kernel logs for unexpected HID devices claiming Apple vendor and product IDs
Correlate USB attach events with subsequent kernel crash dumps to identify malicious HID payloads

Monitoring Recommendations

Ship kernel ring buffer and journal data to a centralized logging pipeline for anomaly analysis on stack overflow signatures
Track running kernel versions across the fleet to identify hosts still exposed to the vulnerable code path
Alert on repeated HID device disconnect and reconnect cycles that may indicate exploitation attempts

How to Mitigate CVE-2026-80783

Immediate Actions Required

Apply the upstream stable kernel updates that include the fix limiting DOUBLE_REPORT_ID recursion to a single level
Unload the hid_magicmouse module on systems that do not use Apple Magic Mouse hardware using modprobe -r hid_magicmouse
Restrict physical and Bluetooth access to production systems to reduce exposure to malicious HID devices

Patch Information

The fix is available across multiple stable branches. Refer to the upstream commits: 26c45ab, 70589b0, 8a10a62, a33a596, bec338b, d095de3, d16df75, and db8d634. Consume the fix through your distribution's kernel security update channel.

Workarounds

Blacklist the hid_magicmouse driver on hosts that do not require Apple pointing device support
Enable CONFIG_VMAP_STACK so that stack exhaustion results in a controlled panic rather than silent memory corruption
Enforce USB device authorization policies to prevent untrusted HID devices from binding to kernel drivers

bash

# Blacklist the hid_magicmouse module
echo 'blacklist hid_magicmouse' | sudo tee /etc/modprobe.d/blacklist-magicmouse.conf
sudo modprobe -r hid_magicmouse

# Verify the module is no longer loaded
lsmod | grep magicmouse

# Optional: require explicit authorization for new USB devices
echo 0 | sudo tee /sys/bus/usb/devices/usb1/authorized_default