Cloudanix VulnDB

CVE-2026-80769

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of certain input devices can cause the whole system to crash when those devices are used.

Exploitation
Requires User Interaction
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Missing hid_is_usb() guard before to_usb_interface() in the rapoo HID driver allows uhid-created devices (reporting BUS_USB without a real USB parent) to reach invalid pointer operations, resulting in kernel splats or crashes.

Why it matters to the business

Systems running affected kernels may experience unexpected crashes or instability when certain HID input devices are attached, leading to downtime and potential loss of device functionality until the kernel is updated.

How an attack unfolds

An attacker or malicious user creates a uhid virtual device that identifies as USB, then triggers HID event paths in the rapoo driver; the absent check causes to_usb_interface() to dereference a non-USB parent, surfacing as a kernel splat (verified in ASAN builds).

How to fix it

Apply the upstream fix that adds the hid_is_usb() check and the USB_HID build dependency before using to_usb_interface(); rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Inspect the rapoo driver source for the hid_is_usb() guard preceding to_usb_interface(); re-test device attachment under an ASAN-enabled kernel to confirm absence of the splat.

Typical attack path

  1. Instantiate a uhid device reporting BUS_USB without a real USB parent
  2. Attach or enumerate the device so the rapoo driver processes it
  3. Trigger HID report or interface handling code path
  4. Invoke to_usb_interface() without the guard, producing kernel splat or oops

How to detect it

Search kernel logs (dmesg, journalctl) for rapoo or hid driver splats, oops, or warnings mentioning to_usb_interface or missing USB parent checks; correlate with recent uhid device creation events.

What your security team should do

  • Prioritize kernel updates containing the rapoo hid_is_usb() fix on all Linux systems exposing HID input
  • Review custom or third-party HID drivers for similar missing parent checks
  • Monitor kernel logs for hid/rapoo related oops until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: HID: rapoo: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't actually have a USB parent. Fix the use of to_usb_interface() without a hid_is_usb() check. Add a dependency on USB_HID for hid_is_usb(), as other HID drivers do; the alternative would be to provide a simple stub implementation on !USB_HID builds. I have verified that it is currently possible to trigger a kernel splat due to this bug in an ASAN build, and that this commit fixes the issue.

Affected packages

Ecosystem Package Introduced Fixed