Executive brief
The Magic Mouse driver in the Linux kernel contains a use-after-free vulnerability that occurs when input device initialization fails. A stale pointer to freed memory is retained and subsequently dereferenced during input event processing, potentially leading to kernel crashes or memory corruption on systems with affected Apple Magic Mouse or Magic Trackpad devices.
Technical details
The vulnerability exists in the HID Magic Mouse driver (drivers/hid/hid-magicmouse.c) where the magicmouse_input_mapping() function caches a pointer to an input device (msc->input) during report descriptor parsing. When hidinput_connect() fails (e.g., due to input_register_device() errors), the HID core frees the input device but does not abort the probe. The cached pointer becomes a dangling reference that passes all NULL checks in ->raw_event and ->event handlers, causing dereferencing of freed memory when the next input report arrives. The fix clears msc->input when HID_CLAIMED_INPUT is not set, ensuring the existing NULL checks prevent access to freed memory.
Affected products
- Linux Linux kernel Multiple versions before fix commit 0af3b89705688af01aa06025b84fa7a1e06ba6cc
Timeline
- 2026-09-04: disclosed
- 2026-08-03: patched: Patch commit 0af3b89705688af01aa06025b84fa7a1e06ba6cc by Jiri Kosina