{"id":"AZL-99600","summary":"CVE-2026-80782 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: magicmouse: do not keep a stale msc-\u003einput if no input is claimed\n\nmagicmouse_input_mapping() caches the first hid_input's input_dev in\nmsc-\u003einput while the report descriptor is parsed, and the rest of the\ndriver treats a non-NULL msc-\u003einput as proof that an input device was\nregistered.\n\nThat does not hold on the hid-input error path. If hidinput_connect()\nfails -- for instance because input_register_device() returns an error --\nit unwinds through hidinput_disconnect(), which frees every input_dev it\ncreated, including the one cached in msc-\u003einput.\n\nThe failure does not abort the probe. hid_connect() only skips the claim:\n\n\tif ((connect_mask & HID_CONNECT_HIDINPUT) && !hidinput_connect(hdev,\n\t\t\t\tconnect_mask & HID_CONNECT_HIDINPUT_FORCE))\n\t\thdev-\u003eclaimed |= HID_CLAIMED_INPUT;\n\nand the \"device has no listeners\" bailout below it does not fire for this\ndriver, which sets -\u003eraw_event; on the USB Magic Mouse 2 / Magic Trackpad\n2 paths hidraw and hiddev are claimed as well. hid_hw_start() therefore\nreturns 0 and magicmouse_probe() continues with msc-\u003einput pointing at\nfreed memory. Being non-NULL, it passes the \"input not registered\" check\nin probe and the NULL checks in -\u003eraw_event and -\u003eevent, so the next\ninput report dereferences freed memory.\n\nClear msc-\u003einput when the HID core did not claim an input device, so the\nexisting NULL checks cover this case as well.","modified":"2026-09-06T05:31:44Z","published":"2026-09-04T16:18:04Z","upstream":["CVE-2026-80782"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80782"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-99600.json"}}],"schema_version":"1.9.0"}