CVE-2026-43140: HID: magicmouse: Do not crash on missing msc->input
In the Linux kernel, the following vulnerability has been resolved:
HID: magicmouse: Do not crash on missing msc->input
Fake USB devices can send their own report descriptors for which the inputmapping() hook does not get called. In this case, msc->input stays NULL, leading to a crash at a later time.
Detect this condition in the inputconfigured() hook and reject the device.
This is not supposed to happen with actual magic mouse devices, but can be provoked by imposing as a magic mouse USB device.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43140?
CVE-2026-43140 has been categorized as a medium severity vulnerability in the Linux kernel.
What impact does CVE-2026-43140 have on affected systems?
CVE-2026-43140 can cause the system to crash due to missing input mappings from fake USB devices.
How do I fix CVE-2026-43140?
To fix CVE-2026-43140, update to a patched version of the Linux kernel that addresses the vulnerability.
Which Linux kernel versions are affected by CVE-2026-43140?
CVE-2026-43140 affects various versions of the Linux kernel between 2.6.37 to 6.19.
Is user action required to mitigate CVE-2026-43140?
Yes, user action is required to apply the appropriate kernel updates to mitigate CVE-2026-43140.