CVE-2026-80774HID: asus: fix missing hid_is_usb() check
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't actually have a USB parent. Fix the use of to_usb_interface() without a hid_is_usb() check. I have verified that it is currently possible to trigger a kernel splat due to this bug in an ASAN build, and that this commit fixes the issue.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ff38cf0bd888fe15789a7193d07c4a876388d520 before bdb2e0a2a359e473ca5619e35adee89028697239; from 00e005c952f74f50a3f86af96f56877be4685e14 before 8b5debb6252cd1e2b6c7adf8f95761a0e743d2cf; from 00e005c952f74f50a3f86af96f56877be4685e14 before 1ddc2f5913bec7a846544d51a8f7a8119573b2a1; from 00e005c952f74f50a3f86af96f56877be4685e14 before ee883906cf6685d753af9c2d2ca9fd6f63197726; from 00e005c952f74f50a3f86af96f56877be4685e14 before 02bf61dfb44f17ec187d1da1a82495951bbd12df; 02d5431198f10e7c6e31f4138c14cfe400ec55a7; from 6.12.35 before 6.12.108; from 6.15.4 before 6.16 | CNA record |
References
- https://git.kernel.org/stable/c/bdb2e0a2a359e473ca5619e35adee89028697239
- https://git.kernel.org/stable/c/8b5debb6252cd1e2b6c7adf8f95761a0e743d2cf
- https://git.kernel.org/stable/c/1ddc2f5913bec7a846544d51a8f7a8119573b2a1
- https://git.kernel.org/stable/c/ee883906cf6685d753af9c2d2ca9fd6f63197726
- https://git.kernel.org/stable/c/02bf61dfb44f17ec187d1da1a82495951bbd12df
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.