Executive brief
The Linux kernel's HID (Human Interface Device) magicmouse driver processes multi-report HID packets from Apple Magic Trackpad devices. A malicious HID device can craft specially formatted packets that trigger unbounded recursion in the packet parsing logic, exhausting the kernel stack and causing a system panic or memory corruption.
Technical details
The vulnerability is an unbounded recursion flaw in the magicmouse_raw_event() function in drivers/hid/hid-magicmouse.c. When processing DOUBLE_REPORT_ID (0xf7) packets, which pack two touch reports into one, the function recursively calls itself to split and process each half. The only guard was a "size < 1" check, which fails to limit recursion depth. A malicious HID device can send a 16 KiB report filled with the pattern [0xf7, 0x00], causing approximately 8,000 nested calls (each consuming 2 bytes per recursion level), exhausting the 16 KiB kernel stack. This results in either a kernel panic (with CONFIG_VMAP_STACK) or memory corruption. Attack requires a malicious USB HID device that matches the magicmouse driver. The fix introduces a "nested" flag parameter to prevent re-entry into the DOUBLE_REPORT_ID handling block after the first recursion, bounding recursion depth to exactly two levels.
Affected products
- Linux Linux kernel All versions with magicmouse HID driver (from kernel 2.6 through at least 6.x series)
Timeline
- 2026-09-04: disclosed
- 2026-09-02: patched: Fix merged in stable trees