CVE-2026-80783 HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()

Q: Is CVE-2026-80783 being exploited?

There is no known exploitation of CVE-2026-80783 in the wild and no public exploit code.

Not scored Published 4 Sep 2026 Updated 19 Oct 2026

A malicious HID device can cause a kernel stack overflow and system crash by sending crafted reports to the magicmouse driver.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-80783?

CVE-2026-80783 is a denial of service vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

In the Linux kernel, the following vulnerability has been resolved:

HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()

magicmouse_raw_event() handles DOUBLE_REPORT_ID (0xf7) packets, which pack two touch reports into one, by splitting the packet and calling itself on each half. The only guard against runaway recursion is a "size < 1" check, which stops zero-sized calls but does not bound the recursion depth.

A malicious HID device that matches this driver can send a report starting with DOUBLE_REPORT_ID and filled with the sequence [0xf7, 0x00]. Each level consumes two bytes and recurses on the remainder, so an incoming report of up to HID_MAX_BUFFER_SIZE (16 KiB) drives roughly 8000 nested calls. That easily exhausts the 16 KiB kernel stack, leading to a stack overflow: a panic with CONFIG_VMAP_STACK, or memory corruption without it.

A double report only ever wraps two normal reports; it is never legitimately nested. Refuse to re-enter the DOUBLE_REPORT_ID case from a recursive call so the recursion depth is bounded to two, while all valid packets keep being parsed exactly as before.

Which versions are affected by CVE-2026-80783?

How do I fix CVE-2026-80783?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-80783 being exploited?