{"id":"CVE-2026-43140","title":"HID: magicmouse: Do not crash on missing msc->input","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: magicmouse: Do not crash on missing msc->input\n\nFake USB devices can send their own report descriptors for which the\ninput_mapping() hook does not get called.  In …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 64eb105d7f92fa48798106ac0d8bf17668eb2524 < db5ba06e7af9325519a03e52fccf4a9e7c1fd9b2","Linux >= 64eb105d7f92fa48798106ac0d8bf17668eb2524 < 165912d4321c692321c02793068d30700b4e0f1a","Linux >= 64eb105d7f92fa48798106ac0d8bf17668eb2524 < f6a3860241fbb556fd72332fa31c5e787004413b","Linux >= 64eb105d7f92fa48798106ac0d8bf17668eb2524 < 243e1165eb03aca97d87aafa9c3130593837a1c2","Linux >= 64eb105d7f92fa48798106ac0d8bf17668eb2524 < 922bd3e498a4b8e445def6e6ffea2ad3682ad516","Linux >= 64eb105d7f92fa48798106ac0d8bf17668eb2524 < 5bbe266272d86c0657e8253600f3d5b74fb7b2ae","Linux >= 64eb105d7f92fa48798106ac0d8bf17668eb2524 < 36c83c1329dd881f290f7df2feadfb9a21775108","Linux >= 64eb105d7f92fa48798106ac0d8bf17668eb2524 < 17abd396548035fbd6179ee1a431bd75d49676a7","Linux 2.6.37"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:29:29.443571Z"},"published":"2026-05-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:32:33.344Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43140","references":[{"url":"https://git.kernel.org/stable/c/db5ba06e7af9325519a03e52fccf4a9e7c1fd9b2"},{"url":"https://git.kernel.org/stable/c/165912d4321c692321c02793068d30700b4e0f1a"},{"url":"https://git.kernel.org/stable/c/f6a3860241fbb556fd72332fa31c5e787004413b"},{"url":"https://git.kernel.org/stable/c/243e1165eb03aca97d87aafa9c3130593837a1c2"},{"url":"https://git.kernel.org/stable/c/922bd3e498a4b8e445def6e6ffea2ad3682ad516"},{"url":"https://git.kernel.org/stable/c/5bbe266272d86c0657e8253600f3d5b74fb7b2ae"},{"url":"https://git.kernel.org/stable/c/36c83c1329dd881f290f7df2feadfb9a21775108"},{"url":"https://git.kernel.org/stable/c/17abd396548035fbd6179ee1a431bd75d49676a7"}],"tags":["cve.org"],"epss":0.00128,"epssPercentile":0.02478,"ingestedAt":"2026-11-06T15:54:04.014Z","slug":"CVE-2026-43140","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: magicmouse: Do not crash on missing msc->input\n\nFake USB devices can send their own report descriptors for which the\ninput_mapping() hook does not get called.  In this case, msc->input stays NULL,\nleading to a crash at a later time.\n\nDetect this condition in the input_configured() hook and reject the device.\n\nThis is not supposed to happen with actual magic mouse devices, but can be\nprovoked by imposing as a magic mouse USB device.\n\n## Affected\n\n- `Linux >= 64eb105d7f92fa48798106ac0d8bf17668eb2524 < db5ba06e7af9325519a03e52fccf4a9e7c1fd9b2`\n- `Linux >= 64eb105d7f92fa48798106ac0d8bf17668eb2524 < 165912d4321c692321c02793068d30700b4e0f1a`\n- `Linux >= 64eb105d7f92fa48798106ac0d8bf17668eb2524 < f6a3860241fbb556fd72332fa31c5e787004413b`\n- `Linux >= 64eb105d7f92fa48798106ac0d8bf17668eb2524 < 243e1165eb03aca97d87aafa9c3130593837a1c2`\n- `Linux >= 64eb105d7f92fa48798106ac0d8bf17668eb2524 < 922bd3e498a4b8e445def6e6ffea2ad3682ad516`\n- `Linux >= 64eb105d7f92fa48798106ac0d8bf17668eb2524 < 5bbe266272d86c0657e8253600f3d5b74fb7b2ae`\n- `Linux >= 64eb105d7f92fa48798106ac0d8bf17668eb2524 < 36c83c1329dd881f290f7df2feadfb9a21775108`\n- `Linux >= 64eb105d7f92fa48798106ac0d8bf17668eb2524 < 17abd396548035fbd6179ee1a431bd75d49676a7`\n- `Linux 2.6.37`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}