CVE-2026-80783: HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
In the Linux kernel, the following vulnerability has been resolved:
HID: magicmouse: prevent unbounded recursion in magicmouserawevent()
magicmouserawevent() handles DOUBLEREPORTID (0xf7) packets, which pack two touch reports into one, by splitting the packet and calling itself on each half. The only guard against runaway recursion is a "size < 1" check, which stops zero-sized calls but does not bound the recursion depth.
A malicious HID device that matches this driver can send a report starting with DOUBLEREPORTID and filled with the sequence [0xf7, 0x00]. Each level consumes two bytes and recurses on the remainder, so an incoming report of up to HIDMAXBUFFERSIZE (16 KiB) drives roughly 8000 nested calls. That easily exhausts the 16 KiB kernel stack, leading to a stack overflow: a panic with CONFIGVMAPSTACK, or memory corruption without it.
A double report only ever wraps two normal reports; it is never legitimately nested. Refuse to re-enter the DOUBLEREPORTID case from a recursive call so the recursion depth is bounded to two, while all valid packets keep being parsed exactly as before.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel magicmouse HID driver are exposed if they accept input from a malicious HID device that matches that driver. The issue is triggered by crafted device reports rather than ordinary nested double reports.
What does an attacker need to exploit it?
An attacker needs to provide a matching malicious HID device and send a report beginning with DOUBLE_REPORT_ID (0xf7) followed by repeated 0xf7, 0x00 sequences. A report up to the 16 KiB HID buffer limit can cause roughly 8,000 nested calls.
What is the impact of successful exploitation?
The crafted report can exhaust the 16 KiB kernel stack. With CONFIG_VMAP_STACK enabled, this causes a kernel panic; without it, it can lead to memory corruption.
What does the fix change?
The fix prevents recursive processing from entering the DOUBLE_REPORT_ID case again, limiting recursion depth to two calls. Valid double-report packets continue to be parsed as before.