Executive brief
The Linux kernel's HID rapoo driver used an unsafe type cast that could trigger a crash when processing certain HID devices. The vulnerability affects the driver module for Rapoo non-compliant HID mouse devices. An attacker could exploit this by creating a specially crafted HID device to cause a kernel panic, disrupting system availability.
Technical details
The vulnerability exists in the HID rapoo driver's probe function, which calls to_usb_interface() without first verifying that the HID device actually has a USB parent. The issue arises because UHID (userspace HID) can create devices that report BUS_USB type but lack an actual USB parent device. The vulnerable code checked only the bus type (hdev->bus == BUS_USB) rather than calling hid_is_usb(hdev) which properly validates the USB parent. An attacker with the ability to create UHID devices can trigger an unsafe pointer dereference leading to a kernel splat/crash. The fix adds a proper hid_is_usb() check and adds a USB_HID dependency to the driver configuration.
Affected products
- Linux Linux kernel Affected across multiple kernel versions; patch available in stable branches
Timeline
- 2026-09-04: disclosed
- 2026-08-27: patched