Executive brief
The Linux kernel's HID ASUS driver contains a missing validation check before casting a device to a USB interface. This can cause a kernel crash when virtual HID devices (created via uhid) are processed, leading to denial of service and system instability on systems with virtual input device drivers.
Technical details
The vulnerability is a type confusion / invalid pointer dereference in the HID ASUS driver (drivers/hid/hid-asus.c). The code calls to_usb_interface() on a hid_device without first verifying via hid_is_usb() that the parent is actually a USB device. Virtual HID devices created by uhid can report BUS_USB without having a real USB parent, causing an unsafe cast and triggering a kernel splat. The vulnerable code path is in asus_kbd_register_leds() when QUIRK_ROG_ALLY_XPAD is set. The fix adds a hid_is_usb() check before the unsafe cast. This is a local denial of service that requires the ability to create virtual HID devices.
Affected products
- Linux Linux kernel affected versions prior to patch commit 02bf61dfb44f17ec187d1da1a82495951bbd12df
Timeline
- 2026-09-04: disclosed: CVE published
- 2026-08-03: patched: Patch merged upstream