{"cve":"CVE-2026-80765","nvd":{"published":"2026-09-04T16:18:01.770","modified":"2026-10-19T09:17:10.477","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hyperv: validate initial device info bounds\n\nThe Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO\nmessages that contain a HID descriptor followed by the report descriptor\nbytes. mousevsc_on_receive_device_info() trusts bLength and\nwDescriptorLength without checking that the received packet contains both\nbyte ranges.\n\nA malformed host or backend message can therefore make the guest read\npast the received VMBus packet while copying the report descriptor. Pass\nthe received initial-device-info size into the parser and reject\ndescriptor lengths that exceed the packet.\n\nImpact: A malicious Hyper-V host or backend can crash a guest by sending\na short initial device-info message with an oversized HID report\ndescriptor length.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/2529737763cb4bcfcaf397beeea2664656c865b4","https://git.kernel.org/stable/c/334271d3812ab3197c95b4593bc6745f8d189114","https://git.kernel.org/stable/c/390d3d9c52a710fdc9de95a537747397c0c671d1","https://git.kernel.org/stable/c/608f8fd8c0f7b6268da43509447802955f210aac","https://git.kernel.org/stable/c/8614c043b11cc35ffebd35542ab4da275f8f923d"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:52:03.409947763+00:00"},"epss":{"cve":"CVE-2026-80765","score":0.00195,"percentile":0.09119,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}