Not yet scoredPublished Sep 4, 2026

CVE-2026-80769HID: rapoo: fix missing hid_is_usb() check

Updated under an hour ago (2026-10-19 08:30 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: HID: rapoo: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't actually have a USB parent. Fix the use of to_usb_interface() without a hid_is_usb() check. Add a dependency on USB_HID for hid_is_usb(), as other HID drivers do; the alternative would be to provide a simple stub implementation on !USB_HID builds. I have verified that it is currently possible to trigger a kernel splat due to this bug in an ASAN build, and that this commit fixes the issue.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Sep 4, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from b3b1c68fb726907ea35ac172906705fe62c7fdaf before 99ed3febafe0452994620a4d819f595583289bec; from b3b1c68fb726907ea35ac172906705fe62c7fdaf before 49b6fd28fbcc0b6457e16e25c7617f63449d4808; from b3b1c68fb726907ea35ac172906705fe62c7fdaf before b57af2448268c30c25509a832b6ff6dc27176b28	CNA record

References

https://git.kernel.org/stable/c/99ed3febafe0452994620a4d819f595583289bec
https://git.kernel.org/stable/c/49b6fd28fbcc0b6457e16e25c7617f63449d4808
https://git.kernel.org/stable/c/b57af2448268c30c25509a832b6ff6dc27176b28

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.