Executive brief
A vulnerability in the Linux kernel's Magic Mouse driver could allow a system crash when a specially crafted USB device is plugged in. By mimicking a legitimate Apple Magic Mouse but providing unexpected data, a malicious device can trigger a kernel failure. This primarily impacts system availability, potentially leading to a denial-of-service on the affected machine.
Technical details
A NULL pointer dereference exists in the HID magicmouse driver (drivers/hid/hid-magicmouse.c) of the Linux kernel. Malicious or 'fake' USB devices can provide custom report descriptors that bypass the input_mapping() hook, leaving the msc->input pointer uninitialized (NULL). When the driver subsequently attempts to use this pointer in the magicmouse_input_configured() function, it triggers a kernel crash. The fix introduces a check in the input_configured() hook to validate the pointer and reject the device if initialization failed. This requires physical access or the ability to emulate a USB device.
Affected products
- Linux Linux Kernel 2.6.37 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-01-09: other: Patch authored
- 2026-05-06: disclosed: CVE published
- 2026-05-13: advisory: NVD analysis completed
References
- https://git.kernel.org/stable/c/165912d4321c692321c02793068d30700b4e0f1a
- https://git.kernel.org/stable/c/17abd396548035fbd6179ee1a431bd75d49676a7
- https://git.kernel.org/stable/c/243e1165eb03aca97d87aafa9c3130593837a1c2
- https://git.kernel.org/stable/c/36c83c1329dd881f290f7df2feadfb9a21775108
- https://git.kernel.org/stable/c/5bbe266272d86c0657e8253600f3d5b74fb7b2ae
- https://git.kernel.org/stable/c/922bd3e498a4b8e445def6e6ffea2ad3682ad516
- https://git.kernel.org/stable/c/db5ba06e7af9325519a03e52fccf4a9e7c1fd9b2