Medium 5.5Published May 6, 2026

CVE-2026-43140HID: magicmouse: Do not crash on missing msc->input

Updated under an hour ago (Oct 27, 2026, 7:30 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: Do not crash on missing msc->input Fake USB devices can send their own report descriptors for which the input_mapping() hook does not get called. In this case, msc->input stays NULL, leading to a crash at a later time. Detect this condition in the input_configured() hook and reject the device. This is not supposed to happen with actual magic mouse devices, but can be provoked by imposing as a magic mouse USB device.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 64eb105d7f92fa48798106ac0d8bf17668eb2524 before db5ba06e7af9325519a03e52fccf4a9e7c1fd9b2; from 64eb105d7f92fa48798106ac0d8bf17668eb2524 before 165912d4321c692321c02793068d30700b4e0f1a; from 64eb105d7f92fa48798106ac0d8bf17668eb2524 before f6a3860241fbb556fd72332fa31c5e787004413b; from 64eb105d7f92fa48798106ac0d8bf17668eb2524 before 243e1165eb03aca97d87aafa9c3130593837a1c2; from 64eb105d7f92fa48798106ac0d8bf17668eb2524 before 922bd3e498a4b8e445def6e6ffea2ad3682ad516; 64eb105d7f92fa48798106ac0d8bf17668eb2524 builds before 5bbe266272d86c0657e8253600f3d5b74fb7b2ae; 64eb105d7f92fa48798106ac0d8bf17668eb2524 builds before 36c83c1329dd881f290f7df2feadfb9a21775108; 64eb105d7f92fa48798106ac0d8bf17668eb2524 builds before 17abd396548035fbd6179ee1a431bd75d49676a7	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.37 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6	NVD

References

References

https://git.kernel.org/stable/c/db5ba06e7af9325519a03e52fccf4a9e7c1fd9b2	patch
https://git.kernel.org/stable/c/165912d4321c692321c02793068d30700b4e0f1a	patch
https://git.kernel.org/stable/c/f6a3860241fbb556fd72332fa31c5e787004413b	patch
https://git.kernel.org/stable/c/243e1165eb03aca97d87aafa9c3130593837a1c2	patch
https://git.kernel.org/stable/c/922bd3e498a4b8e445def6e6ffea2ad3682ad516	patch
https://git.kernel.org/stable/c/5bbe266272d86c0657e8253600f3d5b74fb7b2ae	patch
https://git.kernel.org/stable/c/36c83c1329dd881f290f7df2feadfb9a21775108	patch
https://git.kernel.org/stable/c/17abd396548035fbd6179ee1a431bd75d49676a7	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.