CVE-2026-80782

A flaw was found in the Magic Mouse Human Interface Device (HID) driver within the Linux kernel. When the hidinput_connect() function fails to register an input device, the driver may continue to use a pointer to memory that has already been released. This use-after-free vulnerability can lead to system instability or crashes, and potentially allow a local attacker to escalate privileges or execute arbitrary code.

A use-after-free can occur in the HID magicmouse driver because magicmouse_input_mapping caches an input_dev pointer in msc input before the HID input claim is guaranteed to succeed. If hidinput_connect later fails and frees the created input_dev objects, magicmouse_probe can still continue when other listeners such as raw_event, hidraw, or hiddev are present, leaving msc input as a dangling pointer. A later input report can pass the existing NULL checks and dereference freed memory, causing at least a kernel crash and potentially broader memory corruption impact. For the CVSS the PR:N is used because the paranoid scenario assumes an external malicious or malfunctioning HID device and does not require a local account on the victim. The issue is not reachable over IP networking. Practical exploitation requires Bluetooth adjacent proximity or USB physical access, user action to connect or pair the device, and the hidinput failure path such as input_register_device error. Impact is at least denial of service and worst case may include confidentiality or integrity impact due to the UAF primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.