{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.107-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.12-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.107-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  HID: magicmouse: do not keep a stale msc-\u003einput if no input is claimed  magicmouse_input_mapping() caches the first hid_input's input_dev in msc-\u003einput while the report descriptor is parsed, and the rest of the driver treats a non-NULL msc-\u003einput as proof that an input device was registered.  That does not hold on the hid-input error path. If hidinput_connect() fails -- for instance because input_register_device() returns an error -- it unwinds through hidinput_disconnect(), which frees every input_dev it created, including the one cached in msc-\u003einput.  The failure does not abort the probe. hid_connect() only skips the claim:  \tif ((connect_mask \u0026 HID_CONNECT_HIDINPUT) \u0026\u0026 !hidinput_connect(hdev, \t\t\t\tconnect_mask \u0026 HID_CONNECT_HIDINPUT_FORCE)) \t\thdev-\u003eclaimed |= HID_CLAIMED_INPUT;  and the \"device has no listeners\" bailout below it does not fire for this driver, which sets -\u003eraw_event; on the USB Magic Mouse 2 / Magic Trackpad 2 paths hidraw and hiddev are claimed as well. hid_hw_start() therefore returns 0 and magicmouse_probe() continues with msc-\u003einput pointing at freed memory. Being non-NULL, it passes the \"input not registered\" check in probe and the NULL checks in -\u003eraw_event and -\u003eevent, so the next input report dereferences freed memory.  Clear msc-\u003einput when the HID core did not claim an input device, so the existing NULL checks cover this case as well.",
  "id": "DEBIAN-CVE-2026-80782",
  "modified": "2026-09-19T21:47:23.165307909Z",
  "published": "2026-09-04T16:18:04.030Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-80782"
    }
  ],
  "upstream": [
    "CVE-2026-80782"
  ]
}