CVE-2026-80774: HID: asus: fix missing hid_is_usb() check
In the Linux kernel, the following vulnerability has been resolved:
HID: asus: fix missing hidisusb() check
tousbinterface() can only be used on a hiddevice whose parent is really USB; uhid can create devices that identify as being on BUSUSB, but don't actually have a USB parent. Fix the use of tousbinterface() without a hidisusb() check.
I have verified that it is currently possible to trigger a kernel splat due to this bug in an ASAN build, and that this commit fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the HID ASUS driver, check hid_is_usb() before calling to_usb_interface(), because uhid can create devices that identify as BUS_USB without having a USB parent.
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
An attacker needs the ability to create a uhid device that identifies as BUS_USB. Such a device can lack an actual USB parent, allowing the affected ASUS HID code path to use to_usb_interface() incorrectly.
What is the observed impact of successful triggering?
The issue can trigger a kernel splat, as verified in an ASAN build. The provided information does not establish impacts beyond that observable kernel fault condition.
How can this be mitigated before applying a fix?
Restrict the ability to create or control uhid devices, particularly for untrusted local users or workloads. The vulnerable condition depends on a uhid-created device presenting itself as BUS_USB without a real USB parent.