CVE-2026-80765 HID: hyperv: validate initial device info bounds
A malicious Hyper-V host can crash a Linux guest by sending malformed HID device info messages with oversized descriptor lengths.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80765?
CVE-2026-80765 is a denial of service vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
HID: hyperv: validate initial device info bounds
The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsc_on_receive_device_info() trusts bLength and wDescriptorLength without checking that the received packet contains both byte ranges.
A malformed host or backend message can therefore make the guest read past the received VMBus packet while copying the report descriptor. Pass the received initial-device-info size into the parser and reject descriptor lengths that exceed the packet.
Impact: A malicious Hyper-V host or backend can crash a guest by sending a short initial device-info message with an oversized HID report descriptor length.
Which versions are affected by CVE-2026-80765?
How do I fix CVE-2026-80765?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-80765 being exploited?
There is no known exploitation of CVE-2026-80765 in the wild and no public exploit code.
Sources
Also known as AZL-99615, BELL-CVE-2026-80765, DEBIAN-CVE-2026-80765, GHSA-cj68-x55r-245c, UBUNTU-CVE-2026-80765.