CVE-2026-80774

Source
https://cve.org/CVERecord?id=CVE-2026-80774
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80774.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-80774
Downstream
Related
Published
2026-09-04T15:12:46Z
Modified
2026-10-20T02:30:44Z
Summary
HID: asus: fix missing hid_is_usb() check
Details

In the Linux kernel, the following vulnerability has been resolved:

HID: asus: fix missing hid_is_usb() check

to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't actually have a USB parent. Fix the use of to_usb_interface() without a hid_is_usb() check.

I have verified that it is currently possible to trigger a kernel splat due to this bug in an ASAN build, and that this commit fixes the issue.

Database specific
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80774.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ff38cf0bd888fe15789a7193d07c4a876388d520
Fixed
bdb2e0a2a359e473ca5619e35adee89028697239
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
00e005c952f74f50a3f86af96f56877be4685e14
Fixed
8b5debb6252cd1e2b6c7adf8f95761a0e743d2cf
Fixed
1ddc2f5913bec7a846544d51a8f7a8119573b2a1
Fixed
ee883906cf6685d753af9c2d2ca9fd6f63197726
Fixed
02bf61dfb44f17ec187d1da1a82495951bbd12df
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.12.35
Fixed
6.12.108
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.15.4
Fixed
6.16
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
02d5431198f10e7c6e31f4138c14cfe400ec55a7

Affected versions

v6.*
v6.12.100
v6.12.101
v6.12.102
v6.12.103
v6.12.104
v6.12.105
v6.12.106
v6.12.107
v6.12.35
v6.12.36
v6.12.37
v6.12.38
v6.12.39
v6.12.40
v6.12.41
v6.12.42
v6.12.43
v6.12.44
v6.12.45
v6.12.46
v6.12.47
v6.12.48
v6.12.49
v6.12.50
v6.12.51
v6.12.52
v6.12.53
v6.12.54
v6.12.55
v6.12.56
v6.12.57
v6.12.58
v6.12.59
v6.12.60
v6.12.61
v6.12.62
v6.12.63
v6.12.64
v6.12.65
v6.12.66
v6.12.67
v6.12.68
v6.12.69
v6.12.70
v6.12.71
v6.12.72
v6.12.73
v6.12.74
v6.12.75
v6.12.76
v6.12.77
v6.12.78
v6.12.79
v6.12.80
v6.12.81
v6.12.82
v6.12.83
v6.12.84
v6.12.85
v6.12.86
v6.12.87
v6.12.88
v6.12.89
v6.12.90
v6.12.91
v6.12.92
v6.12.93
v6.12.94
v6.12.95
v6.12.96
v6.12.97
v6.12.98
v6.12.99
v6.15.10
v6.15.11
v6.15.4
v6.15.5
v6.15.6
v6.15.7
v6.15.8
v6.15.9

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80774.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.12.108
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.49
Type
ECOSYSTEM
Events
Introduced
6.16.0
Fixed
7.1.11
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.1

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80774.json"