Cloudanix VulnDB

CVE-2026-80765

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how Linux inside a virtual machine reads certain setup messages from its Windows host can let that host crash the Linux system.

Exploitation
Other
Attacker needs
Other
Complexity
Trivial
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing bounds validation in mousevsc_on_receive_device_info allows a short VMBus SYNTH_HID_INITIAL_DEVICE_INFO packet to supply oversized bLength/wDescriptorLength values, causing the guest kernel to read past the received packet buffer while copying the HID report descriptor.

Why it matters to the business

A malicious or compromised Hyper-V host can trigger denial-of-service crashes in Linux guest kernels, disrupting workloads that rely on virtual HID devices and requiring manual recovery or reboot.

How an attack unfolds

The attacker controls the Hyper-V host or backend and crafts a SYNTH_HID_INITIAL_DEVICE_INFO message whose reported descriptor lengths exceed the actual packet size; when the guest parses the message it performs an out-of-bounds read, resulting in a kernel panic.

How to fix it

Apply the upstream kernel patch that passes the received packet size into the HID descriptor parser and rejects lengths exceeding the packet; rebuild and deploy the fixed kernel to all Hyper-V Linux guests.

How to confirm the fix worked

Confirm the presence of the bounds check that compares wDescriptorLength against the supplied initial-device-info size before copying; test by replaying a short oversized packet and verifying the guest rejects it without crashing.

Typical attack path

  1. Gain control of the Hyper-V host or synthetic HID backend
  2. Send a malformed VMBus packet containing SYNTH_HID_INITIAL_DEVICE_INFO with inflated descriptor lengths but truncated payload
  3. Trigger mousevsc_on_receive_device_info in the guest kernel
  4. Cause out-of-bounds memory read and guest kernel crash

How to detect it

Monitor kernel logs for oops/panic entries referencing mousevsc_on_receive_device_info or hyperv HID descriptor parsing; inspect VMBus traffic for SYNTH_HID_INITIAL_DEVICE_INFO messages whose declared lengths exceed observed packet size.

  • mousevsc_on_receive_device_info
  • SYNTH_HID_INITIAL_DEVICE_INFO

What your security team should do

  • Prioritize kernel updates on all Linux guests running under Hyper-V within the next maintenance window
  • Enable kernel panic logging and watchdog monitoring to detect HID-related crashes quickly
  • Review hypervisor hardening and isolation controls to reduce the chance of a compromised host reaching guest VMBus channels

The record

In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsc_on_receive_device_info() trusts bLength and wDescriptorLength without checking that the received packet contains both byte ranges. A malformed host or backend message can therefore make the guest read past the received VMBus packet while copying the report descriptor. Pass the received initial-device-info size into the parser and reject descriptor lengths that exceed the packet. Impact: A malicious Hyper-V host or backend can crash a guest by sending a short initial device-info message with an oversized HID report descriptor length.

Affected packages

Ecosystem Package Introduced Fixed