CVE-2021-47120

What it actually does

The HID magicmouse driver probe returns success after a failed sanity check for Apple Trackpad 2 instead of -ENODEV, leaving driver data uninitialized so that the remove callback dereferences a NULL pointer on USB disconnect.

Why it matters to the business

Systems using affected Apple Magic Trackpad hardware may experience kernel crashes or instability on device removal, resulting in denial of service and potential data loss for unsaved work.

How an attack unfolds

An attacker with physical access connects an Apple Magic Trackpad 2, allows the driver to bind despite the failed check, then disconnects the device to trigger the remove handler and NULL dereference.

How to fix it

Upgrade the affected package to the fixed version: omping 0.0.4-18.el8 on AlmaLinux 8. Reboot if a kernel module update is included and verify the driver no longer returns success on the sanity-check failure path.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the fixed release, then test connect/disconnect of an Apple Magic Trackpad 2 while monitoring dmesg for NULL dereference oops messages.

Typical attack path

1. Physically connect a supported Apple Magic Trackpad 2 device
2. Allow the magicmouse driver to attempt binding
3. Disconnect the USB device to invoke the remove callback

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) around USB disconnect events for magicmouse or HID oops traces; correlate with physical device attachment times.

What your security team should do

• Apply the vendor-supplied package update immediately on affected systems
• Disable the magicmouse driver via modprobe blacklist if hardware is not required
• Monitor kernel logs for HID-related oops entries during device removal