CVE-2026-80918

A flaw was found in the Linux kernel's Human Interface Device (HID) core. When a specially crafted HID device is connected, a type confusion vulnerability can occur during the processing of its descriptor. This allows the kernel to incorrectly interpret a memory address as a numerical value, leading to the disclosure of sensitive kernel pointer information in system logs. This information could potentially be used by an attacker to bypass security measures.

This vulnerability is rated with a Low severity because exploitation requires local or physical interaction to attach a malformed peripheral, and the blast radius is restricted to disclosing partial kernel memory addresses into system diagnostic logs. In typical Red Hat Enterprise Linux enterprise deployments, systems operate in restricted physical environments or virtualized infrastructures where unauthorized hardware insertion is prevented. While virtualized environments permitting device passthrough or emulation may expose the interface, the leaked address fragment alone does not compromise host stability or directly grant elevated privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.