HIGH Introduced in 7.0
hid rapoo TypeConfusion
CVE-2026-80769
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: HID: rapoo: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't actually have a USB parent. Fix the use of to_usb_interface() without a hid_is_usb() check. Add a dependency on USB_HID for hid_is_usb(), as other HID drivers do; the alternative would be to provide a simple stub implementation on !USB_HID builds. I have verified that it is currently possible to trigger a kernel splat due to this bug in an ASAN build, and that this commit fixes the issue.
02KernelScan AI Analysis
Risk summary
The Rapoo HID driver treats any device reporting BUS_USB as having a genuine USB parent, but userspace-created virtual HID devices via uhid can set this bus type without an actual USB parent. This causes the driver to reinterpret an unrelated kernel object as a USB interface structure, leading to invalid memory access. An attacker with access to the uhid interface and the rapoo module loaded can trigger kernel memory corruption or a crash.
Vulnerability analysis
The Rapoo driver assumes that any HID device claiming a USB bus connection truly has a USB parent device. However, userspace can create virtual HID devices through the uhid interface that falsely claim to be on the USB bus while actually having a different parent. When the driver treats that unrelated parent as a USB interface, it accesses memory at the wrong layout, causing a type confusion that can leak or corrupt kernel memory and crash the system. The corrected code now verifies that the device is genuinely backed by USB hardware before treating it as such, and the driver now depends on the USB HID subsystem to ensure that check is available. A local user who can access the uhid device node can trigger this flaw while the Rapoo driver is loaded.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.1 | 7.0 | 7.1.11 | 99ed3febafe0 |
| 7.2 | 7.0 | 7.2.1 | 49b6fd28fbcc |
| mainline | 7.0 | 7.3-rc1 | b57af2448268 |