{"id":"CVE-2026-80774","title":"HID: asus: fix missing hid_is_usb() check","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: asus: fix missing hid_is_usb() check\n\nto_usb_interface() can only be used on a hid_device whose parent is really\nUSB; uhid can create devices that identify as bein…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= ff38cf0bd888fe15789a7193d07c4a876388d520 < bdb2e0a2a359e473ca5619e35adee89028697239","Linux >= 00e005c952f74f50a3f86af96f56877be4685e14 < 8b5debb6252cd1e2b6c7adf8f95761a0e743d2cf","Linux >= 00e005c952f74f50a3f86af96f56877be4685e14 < 1ddc2f5913bec7a846544d51a8f7a8119573b2a1","Linux >= 00e005c952f74f50a3f86af96f56877be4685e14 < ee883906cf6685d753af9c2d2ca9fd6f63197726","Linux >= 00e005c952f74f50a3f86af96f56877be4685e14 < 02bf61dfb44f17ec187d1da1a82495951bbd12df","Linux 02d5431198f10e7c6e31f4138c14cfe400ec55a7","Linux >= 6.12.35 < 6.12.108","Linux >= 6.15.4 < 6.16","Linux 6.16"],"published":"2026-09-04","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:43:30.740Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80774","references":[{"url":"https://git.kernel.org/stable/c/bdb2e0a2a359e473ca5619e35adee89028697239"},{"url":"https://git.kernel.org/stable/c/8b5debb6252cd1e2b6c7adf8f95761a0e743d2cf"},{"url":"https://git.kernel.org/stable/c/1ddc2f5913bec7a846544d51a8f7a8119573b2a1"},{"url":"https://git.kernel.org/stable/c/ee883906cf6685d753af9c2d2ca9fd6f63197726"},{"url":"https://git.kernel.org/stable/c/02bf61dfb44f17ec187d1da1a82495951bbd12df"}],"tags":["cve.org"],"epss":0.00168,"epssPercentile":0.05681,"ingestedAt":"2026-10-19T10:20:54.954Z","slug":"CVE-2026-80774","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: asus: fix missing hid_is_usb() check\n\nto_usb_interface() can only be used on a hid_device whose parent is really\nUSB; uhid can create devices that identify as being on BUS_USB, but don't\nactually have a USB parent.\nFix the use of to_usb_interface() without a hid_is_usb() check.\n\nI have verified that it is currently possible to trigger a kernel splat due\nto this bug in an ASAN build, and that this commit fixes the issue.\n\n## Affected\n\n- `Linux >= ff38cf0bd888fe15789a7193d07c4a876388d520 < bdb2e0a2a359e473ca5619e35adee89028697239`\n- `Linux >= 00e005c952f74f50a3f86af96f56877be4685e14 < 8b5debb6252cd1e2b6c7adf8f95761a0e743d2cf`\n- `Linux >= 00e005c952f74f50a3f86af96f56877be4685e14 < 1ddc2f5913bec7a846544d51a8f7a8119573b2a1`\n- `Linux >= 00e005c952f74f50a3f86af96f56877be4685e14 < ee883906cf6685d753af9c2d2ca9fd6f63197726`\n- `Linux >= 00e005c952f74f50a3f86af96f56877be4685e14 < 02bf61dfb44f17ec187d1da1a82495951bbd12df`\n- `Linux 02d5431198f10e7c6e31f4138c14cfe400ec55a7`\n- `Linux >= 6.12.35 < 6.12.108`\n- `Linux >= 6.15.4 < 6.16`\n- `Linux 6.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}