CVE-2026-80765

A flaw was found in the Linux kernel's Hyper-V synthetic Human Interface Device (HID) host. A malicious Hyper-V host or backend can send a specially crafted initial device information message to a guest system. This message, containing an oversized HID report descriptor length, can cause the guest to read beyond the intended memory boundary. Successful exploitation of this vulnerability leads to a denial of service (DoS) by crashing the guest operating system.

A bounds validation bug in the Hyper-V HID guest driver allows a malformed SYNTH_HID_INITIAL_DEVICE_INFO message to make the guest read past the received VMBus packet while copying the HID report descriptor. A malicious Hyper-V host or backend can trigger this by sending a short initial device info message with oversized HID descriptor or report descriptor length fields, causing a guest kernel crash. For the CVSS the PR:H is used because reliable triggering normally requires control over the Hyper-V host side or backend that supplies synthetic HID messages to the guest. The issue is not network reachable and is a host to guest virtualization path rather than packet traffic. Impact is primarily denial of service of the guest. The paranoid score keeps limited confidentiality impact because the primitive is an out-of-bounds read in guest kernel context, but there is no clear write primitive or privilege escalation path supported by the patch.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.