CVE-2026-80773 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
HID: huawei: fix missing hid_is_usb() check
to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't actually have a USB parent. Fix the use of to_usb_interface() without a hid_is_usb() check.
I have verified that it is currently possible to trigger a kernel splat due to this bug in an ASAN build, and that this commit fixes the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified within the Linux kernel's Human Interface Device subsystem involves improper type casting of device structures without verifying their underlying transport layer. Specifically, the huawei HID driver utilizes the to_usb_interface macro to access USB-specific data associated with a hid_device structure. This operation assumes that the parent bus of the input device is physically connected via Universal Serial Bus technology. However, this assumption fails when devices are created through uhid, which is a userspace interface for creating virtual HID devices. Although these virtual devices may report their bus type as BUS_USB to maintain compatibility with existing drivers, they do not possess an actual USB parent structure in the kernel's internal representation. Consequently, casting such a device directly to a usb_interface pointer results in accessing memory that does not correspond to valid USB interface data structures.
This logical flaw leads to undefined behavior within the kernel space, manifesting as a kernel splat or crash when accessed under stress testing conditions such as AddressSanitizer builds. The root cause is classified under CWE-824, which covers access of a pointer whose value is a near-null, garbage, or otherwise invalid address. In this context, the invalidity stems from treating a virtual device structure as if it were physically backed by USB hardware resources. The absence of a preliminary check using hid_is_usb allows the driver to proceed with operations that require valid USB interface pointers, thereby triggering memory corruption or segmentation faults when the kernel attempts to dereference fields specific to usb_interface structures on data layouts that do not support them.
From an operational perspective, this vulnerability can be exploited by local users who have access to create uhid devices, potentially leading to a denial of service through system instability or crash. While remote exploitation is unlikely due to the requirement for physical or virtual device creation privileges, the impact remains significant for systems relying on HID input stability. The flaw highlights a broader category of issues where drivers fail to validate the actual hardware topology before performing type-specific operations. This aligns with ATT&CK technique T1059, Command and Scripting Interpreter, if an attacker leverages such instability to facilitate further exploitation steps like privilege escalation via kernel memory corruption, although the primary immediate impact is system reliability degradation.
To mitigate this vulnerability, it is essential to enforce strict validation of device bus types before performing any casts or accesses specific to that transport layer. The fix involves inserting a call to hid_is_usb prior to invoking to_usb_interface, ensuring that the driver only proceeds with USB-specific logic when the parent device genuinely possesses a USB interface structure. This defensive programming practice prevents invalid memory access and maintains kernel integrity across diverse input device configurations. System administrators should apply the corresponding kernel patch or update their distribution packages to include this correction, thereby eliminating the risk of crashes triggered by virtual HID devices masquerading as physical USB peripherals.