HIGH Introduced in 3.3
hid-hyperv DeviceInfo OOB
CVE-2026-80765
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsc_on_receive_device_info() trusts bLength and wDescriptorLength without checking that the received packet contains both byte ranges. A malformed host or backend message can therefore make the guest read past the received VMBus packet while copying the report descriptor. Pass the received initial-device-info size into the parser and reject descriptor lengths that exceed the packet. Impact: A malicious Hyper-V host or backend can crash a guest by sending a short initial device-info message with an oversized HID report descriptor length.
02KernelScan AI Analysis
Risk summary
A malicious Hyper-V host or backend can send a malformed synthetic HID initial device-info message with an oversized report descriptor length, causing the guest kernel to read past the VMBus packet buffer. This results in a guest kernel crash (denial of service). The vulnerability requires a malicious host or backend, not a network attacker.
Vulnerability analysis
The Hyper-V synthetic HID driver trusts descriptor length fields in initial device-info messages without verifying they fit within the received VMBus packet. A malicious host or backend can send a short message with an oversized HID report descriptor length, causing the guest to read past the packet buffer while copying the report descriptor, leading to a kernel crash. The fix passes the received packet size into the parser and rejects descriptor lengths that exceed the available data, also validating the HID descriptor length against the packet bounds. This is reachable only from the Hyper-V host or backend over the VMBus channel; a guest cannot trigger it locally.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.3 | 5.10.267 | e0d5d3e45e14 |
| 5.15 | 3.3 | 5.15.218 | 390d3d9c52a7 |
| 6.1 | 3.3 | 6.1.185 | 8614c043b11c |
| 6.12 | 3.3 | 6.12.106 | f84d777574b7 |
| 6.18 | 3.3 | 6.18.47 | 608f8fd8c0f7 |
| 6.6 | 3.3 | 6.6.154 | 334271d3812a |
| 7.1 | 3.3 | 7.1.11 | 2529737763cb |
| 7.2 | 3.3 | 7.2.1 | c894143c508a |
| mainline | 3.3 | 7.3 | 934b7778aa7b |
| cip/5.10 | 3.3 | 5.10.268-cip77 | e0d5d3e45e14 |
| cip/5.10-rt | 3.3 | 5.10.268-cip77-rt34 | e0d5d3e45e14 |
| cip/6.1 | 3.3 | 6.1.187-cip60 | 8614c043b11c |
| cip/6.1-rt | 3.3 | 6.1.189-cip61-rt32 | 8614c043b11c |
| cip/6.12 | 3.3 | 6.12.108-cip31 | f84d777574b7 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.108-cip31 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |