HID: hyperv: validate initial device info bounds
In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsc_on_receive_device_info() trusts bLength and wDescriptorLength without checking that the received packet contains both byte ranges. A malformed host or backend message can therefore make the guest read past the received VMBus packet while copying the report descriptor. Pass the received initial-device-info size into the parser and reject descriptor lengths that exceed the packet. Impact: A malicious Hyper-V host or backend can crash a guest by sending a short initial device-info message with an oversized HID report descriptor length.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.267, 5.15.218, 6.1.185, 6.12.106, 6.18.47, 6.6.154, 7.1.11, 7.2.1
- CVEs
- CVE-2026-80765
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 01:24 UTC · Revision 1
Source evidence
HID: hyperv: validate initial device info bounds
core-osv · Original sourcePublished 4 Sept 2026, 15:12 UTC
In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsc_on_receive_device_info() trusts bLength and wDescriptorLength without checking that the received packet contains both byte ranges. A malformed host or backend message can therefore make the guest read past the received VMBus packet while copying the report descriptor. Pass the received initial-device-info size into the parser and reject descriptor lengths that exceed the packet. Impact: A malicious Hyper-V host or backend can crash a guest by sending a short initial device-info message with an oversized HID report descriptor length.
osv:CVE-2026-80765
Kernel
Fixed versions: 5.10.267, 5.15.218, 6.1.185, 6.6.154, 6.12.106, 6.18.47, 7.1.11, 7.2.1
Complete source record
{
"id": "6f45b0a77767937730d6ad67eafe38c0a048d5c228d007d998f7d00ef62b8aae",
"url": "https://osv.dev/vulnerability/CVE-2026-80765",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "HID: hyperv: validate initial device info bounds",
"summary": "In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsc_on_receive_device_info() trusts bLength and wDescriptorLength without checking that the received packet contains both byte ranges. A malformed host or backend message can therefore make the guest read past the received VMBus packet while copying the report descriptor. Pass the received initial-device-info size into the parser and reject descriptor lengths that exceed the packet. Impact: A malicious Hyper-V host or backend can crash a guest by sending a short initial device-info message with an oversized HID report descriptor length.",
"evidence": "osv:CVE-2026-80765",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.267",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.218",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.185",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.154",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.106",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.47",
"evidence": "/affected/1/ranges"
},
{
"value": "7.1.11",
"evidence": "/affected/1/ranges"
},
{
"value": "7.2.1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-80765",
"aliases": [
"CVE-2026-80765"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "b95f5bcb811e3905b5376f87789da8d097fee682"
},
{
"fixed": "e0d5d3e45e142b7ef7525654aaa54d3e986002a6"
},
{
"fixed": "390d3d9c52a710fdc9de95a537747397c0c671d1"
},
{
"fixed": "8614c043b11cc35ffebd35542ab4da275f8f923d"
},
{
"fixed": "334271d3812ab3197c95b4593bc6745f8d189114"
},
{
"fixed": "f84d777574b748b1a488723ca7be9d87a301a872"
},
{
"fixed": "608f8fd8c0f7b6268da43509447802955f210aac"
},
{
"fixed": "2529737763cb4bcfcaf397beeea2664656c865b4"
},
{
"fixed": "c894143c508a7e063aab9f73c9e835ab40121283"
},
{
"fixed": "934b7778aa7b7c8f6bb073d2a73ba3674885bae0"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80765.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.3.0"
},
{
"fixed": "5.10.267"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.218"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.185"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.154"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.106"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.47"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.1.11"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.2.0"
},
{
"fixed": "7.2.1"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80765.json"
}
}
],
"modified": "2026-10-28T02:30:24.911118476Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/2529737763cb4bcfcaf397beeea2664656c865b4",
"https://git.kernel.org/stable/c/334271d3812ab3197c95b4593bc6745f8d189114",
"https://git.kernel.org/stable/c/390d3d9c52a710fdc9de95a537747397c0c671d1",
"https://git.kernel.org/stable/c/608f8fd8c0f7b6268da43509447802955f210aac",
"https://git.kernel.org/stable/c/8614c043b11cc35ffebd35542ab4da275f8f923d",
"https://git.kernel.org/stable/c/934b7778aa7b7c8f6bb073d2a73ba3674885bae0",
"https://git.kernel.org/stable/c/c894143c508a7e063aab9f73c9e835ab40121283",
"https://git.kernel.org/stable/c/e0d5d3e45e142b7ef7525654aaa54d3e986002a6",
"https://git.kernel.org/stable/c/f84d777574b748b1a488723ca7be9d87a301a872",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80765.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-80765",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80765.json"
}
},
"related_cves": [
{
"value": "CVE-2026-80765",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 491614,
"published_at": "2026-09-04T15:12:37.639+00:00"
}