CVE-2026-80774

HID: asus: fix missing hid_is_usb() check

State: Published
Severity: Not scored
Published: Sep 4, 2026
Updated: Oct 19, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: asus: fix missing hid_is_usb() check

to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't actually have a USB parent. Fix the use of to_usb_interface() without a hid_is_usb() check.

I have verified that it is currently possible to trigger a kernel splat due to this bug in an ASAN build, and that this commit fixes the issue.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ff38cf0bd888fe15789a7193d07c4a876388d520 to before bdb2e0a2a359e473ca5619e35adee89028697239Affected 00e005c952f74f50a3f86af96f56877be4685e14 to before 8b5debb6252cd1e2b6c7adf8f95761a0e743d2cfAffected 00e005c952f74f50a3f86af96f56877be4685e14 to before 1ddc2f5913bec7a846544d51a8f7a8119573b2a1Affected 00e005c952f74f50a3f86af96f56877be4685e14 to before ee883906cf6685d753af9c2d2ca9fd6f63197726Affected 00e005c952f74f50a3f86af96f56877be4685e14 to before 02bf61dfb44f17ec187d1da1a82495951bbd12dfAffected 02d5431198f10e7c6e31f4138c14cfe400ec55a7Affected 6.12.35 to before 6.12.108Affected 6.15.4 to before 6.16Affected
LinuxLinux	6.16Affected before 6.16Not affected 6.12.108 through 6.12.Not affected 6.18.49 through 6.18.Not affected 7.1.11 through 7.1.Not affected 7.2.1 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

ff38cf0bd888fe15789a7193d07c4a876388d520 to before bdb2e0a2a359e473ca5619e35adee89028697239Affected
00e005c952f74f50a3f86af96f56877be4685e14 to before 8b5debb6252cd1e2b6c7adf8f95761a0e743d2cfAffected
00e005c952f74f50a3f86af96f56877be4685e14 to before 1ddc2f5913bec7a846544d51a8f7a8119573b2a1Affected
00e005c952f74f50a3f86af96f56877be4685e14 to before ee883906cf6685d753af9c2d2ca9fd6f63197726Affected
00e005c952f74f50a3f86af96f56877be4685e14 to before 02bf61dfb44f17ec187d1da1a82495951bbd12dfAffected
02d5431198f10e7c6e31f4138c14cfe400ec55a7Affected
6.12.35 to before 6.12.108Affected
6.15.4 to before 6.16Affected

LinuxLinux

6.16Affected
before 6.16Not affected
6.12.108 through 6.12.*Not affected
6.18.49 through 6.18.*Not affected
7.1.11 through 7.1.*Not affected
7.2.1 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.