CVE-2026-80765

HID: hyperv: validate initial device info bounds

Published Sep 4, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: hyperv: validate initial device info bounds

The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO
messages that contain a HID descriptor followed by the report descriptor
bytes. mousevsc_on_receive_device_info() trusts bLength and
wDescriptorLength without checking that the received packet contains both
byte ranges.

A malformed host or backend message can therefore make the guest read
past the received VMBus packet while copying the report descriptor. Pass
the received initial-device-info size into the parser and reject
descriptor lengths that exceed the packet.

Impact: A malicious Hyper-V host or backend can crash a guest by sending
a short initial device-info message with an oversized HID report
descriptor length.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b95f5bcb811e3905b5376f87789da8d097fee682`	affected	< e0d5d3e45e142b7ef7525654aaa54d3e986002a6
`b95f5bcb811e3905b5376f87789da8d097fee682`	affected	< 390d3d9c52a710fdc9de95a537747397c0c671d1
`b95f5bcb811e3905b5376f87789da8d097fee682`	affected	< 8614c043b11cc35ffebd35542ab4da275f8f923d
`b95f5bcb811e3905b5376f87789da8d097fee682`	affected	< 334271d3812ab3197c95b4593bc6745f8d189114
`b95f5bcb811e3905b5376f87789da8d097fee682`	affected	< f84d777574b748b1a488723ca7be9d87a301a872
`b95f5bcb811e3905b5376f87789da8d097fee682`	affected	< 608f8fd8c0f7b6268da43509447802955f210aac
`b95f5bcb811e3905b5376f87789da8d097fee682`	affected	< 2529737763cb4bcfcaf397beeea2664656c865b4
`b95f5bcb811e3905b5376f87789da8d097fee682`	affected	< c894143c508a7e063aab9f73c9e835ab40121283
`b95f5bcb811e3905b5376f87789da8d097fee682`	affected	< 934b7778aa7b7c8f6bb073d2a73ba3674885bae0

Linux

affected

Version	Status	Constraints
`3.3`	affected	—
`0`	unaffected	< 3.3
`5.10.267`	unaffected	≤ 5.10.*
`5.15.218`	unaffected	≤ 5.15.*
`6.1.185`	unaffected	≤ 6.1.*
`6.6.154`	unaffected	≤ 6.6.*
`6.12.106`	unaffected	≤ 6.12.*
`6.18.47`	unaffected	≤ 6.18.*
`7.1.11`	unaffected	≤ 7.1.*
`7.2.1`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[b95f5bcb811e3905b5376f87789da8d097fee682,e0d5d3e45e142b7ef7525654aaa54d3e986002a6)`	affected	code_commit	—
`[b95f5bcb811e3905b5376f87789da8d097fee682,390d3d9c52a710fdc9de95a537747397c0c671d1)`	affected	code_commit	—
`[b95f5bcb811e3905b5376f87789da8d097fee682,8614c043b11cc35ffebd35542ab4da275f8f923d)`	affected	code_commit	—
`[b95f5bcb811e3905b5376f87789da8d097fee682,334271d3812ab3197c95b4593bc6745f8d189114)`	affected	code_commit	—
`[b95f5bcb811e3905b5376f87789da8d097fee682,f84d777574b748b1a488723ca7be9d87a301a872)`	affected	code_commit	—
`[b95f5bcb811e3905b5376f87789da8d097fee682,608f8fd8c0f7b6268da43509447802955f210aac)`	affected	code_commit	—
`[b95f5bcb811e3905b5376f87789da8d097fee682,2529737763cb4bcfcaf397beeea2664656c865b4)`	affected	code_commit	—
`[b95f5bcb811e3905b5376f87789da8d097fee682,c894143c508a7e063aab9f73c9e835ab40121283)`	affected	code_commit	—
`[b95f5bcb811e3905b5376f87789da8d097fee682,934b7778aa7b7c8f6bb073d2a73ba3674885bae0)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`3.3`	affected	generic	—
`[0,3.3)`	unaffected	semver	—
`[5.10.267,5.11.0)`	unaffected	semver	—
`[5.15.218,5.16.0)`	unaffected	semver	—
`[6.1.185,6.2.0)`	unaffected	semver	—
`[6.6.154,6.7.0)`	unaffected	semver	—
`[6.12.106,6.13.0)`	unaffected	semver	—
`[6.18.47,6.19.0)`	unaffected	semver	—
`[7.1.11,7.2.0)`	unaffected	semver	—
`[7.2.1,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.195% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/2529737763cb4bcfcaf397beeea2664656c865b4
https://git.kernel.org/stable/c/334271d3812ab3197c95b4593bc6745f8d189114
https://git.kernel.org/stable/c/390d3d9c52a710fdc9de95a537747397c0c671d1
https://git.kernel.org/stable/c/608f8fd8c0f7b6268da43509447802955f210aac
https://git.kernel.org/stable/c/8614c043b11cc35ffebd35542ab4da275f8f923d
https://git.kernel.org/stable/c/934b7778aa7b7c8f6bb073d2a73ba3674885bae0
https://git.kernel.org/stable/c/c894143c508a7e063aab9f73c9e835ab40121283
https://git.kernel.org/stable/c/e0d5d3e45e142b7ef7525654aaa54d3e986002a6
https://git.kernel.org/stable/c/f84d777574b748b1a488723ca7be9d87a301a872

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 4, 2026 9:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125

Sep 4, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsc_on_receive_device_info() trusts bLength and wDescriptorLength without checking that the received packet contains both byte ranges. A malformed host or backend message can therefore make the guest read past the received VMBus packet while copying the report descriptor. Pass the received initial-device-info size into the parser and reject descriptor lengths that exceed the packet. Impact: A malicious Hyper-V host or backend can crash a guest by sending a short initial device-info message with an oversized HID report descriptor length.
Title		HID: hyperv: validate initial device info bounds
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2529737763cb4bcfcaf397beeea2664656c865b4 https://git.kernel.org/stable/c/334271d3812ab3197c95b4593bc6745f8d189114 https://git.kernel.org/stable/c/390d3d9c52a710fdc9de95a537747397c0c671d1 https://git.kernel.org/stable/c/608f8fd8c0f7b6268da43509447802955f210aac https://git.kernel.org/stable/c/8614c043b11cc35ffebd35542ab4da275f8f923d https://git.kernel.org/stable/c/934b7778aa7b7c8f6bb073d2a73ba3674885bae0 https://git.kernel.org/stable/c/c894143c508a7e063aab9f73c9e835ab40121283 https://git.kernel.org/stable/c/e0d5d3e45e142b7ef7525654aaa54d3e986002a6 https://git.kernel.org/stable/c/f84d777574b748b1a488723ca7be9d87a301a872