Executive brief
The Linux kernel's Hyper-V synthetic HID (Human Interface Device) driver processes device initialization messages from a Hyper-V host without validating descriptor length fields. A malicious or compromised Hyper-V host can send crafted messages with oversized descriptor lengths, causing the guest kernel to read past the received packet boundary and crash.
Technical details
The vulnerability is a bounds-checking flaw in the HID over Hyper-V driver (drivers/hid/hid-hyperv.c). The mousevsc_on_receive_device_info() function processes SYNTH_HID_INITIAL_DEVICE_INFO messages containing HID and report descriptors but failed to validate that the descriptor length fields (bLength and wDescriptorLength) stay within the received packet boundaries. An attacker controlling the Hyper-V host or backend can send a packet with an oversized descriptor length, triggering a buffer over-read when the driver copies descriptor data. The fix adds size validation checks to ensure descriptor offsets and lengths do not exceed the received message size. Exploitation requires host-level access and causes denial of service via guest kernel crash.
Affected products
- Linux Linux kernel affected versions prior to the patch (all versions with Hyper-V HID driver)
Timeline
- 2026-09-04: disclosed
- 2026-08-27: patched: Upstream commit 934b7778aa7b7c8f6bb073d2a73ba3674885bae0