Type Confusion in Linux kernel - CVE-2026-80918

Vulnerability identifier: #VU148845

CSH Severity: Low

CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-80918

CWE-ID: CWE-843

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker with physical access to disclose kernel pointer information.

The vulnerability exists due to type confusion in item_udata() and item_sdata() in the HID core when processing long-format HID descriptor items. An attacker with physical access can connect a HID device containing a crafted long-format report size item to disclose kernel pointer information.

The issue affects hid_scan_report(); hid_parse_collections() stops processing when it encounters a long item.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-kvm (Ubuntu package)
linux-gcp (Ubuntu package)
linux-aws (Ubuntu package)
linux-azure (Ubuntu package)
linux-oracle (Ubuntu package)
linux-lowlatency (Ubuntu package)
linux-gke (Ubuntu package)
linux-aws-5.15 (Ubuntu package)
linux-lowlatency-hwe-5.15 (Ubuntu package)
linux-hwe-5.15 (Ubuntu package)
linux-fips (Ubuntu package)
linux-azure-5.15 (Ubuntu package)
linux-azure-fde-5.15 (Ubuntu package)
linux-ibm-5.15 (Ubuntu package)
linux-intel-iotg (Ubuntu package)
linux-realtime (Ubuntu package)
linux-gkeop (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-nvidia-tegra (Ubuntu package)
linux-ibm (Ubuntu package)
linux-intel-iotg-5.15 (Ubuntu package)
linux-oracle-5.15 (Ubuntu package)
linux-gcp-5.15 (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-intel-iot-realtime (Ubuntu package)
linux-gcp-fips (Ubuntu package)
linux-aws-fips (Ubuntu package)
linux-azure-fips (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

linux (Ubuntu package) - update to 7.0.0-42.42
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-nvidia-tegra (Ubuntu package) - update to 5.15.0-1070.72
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux-azure-fde (Ubuntu package) - update to 5.15.0-1124.133
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/1fa1591efd417e39e5e164bebea8ca7a3837c469
• https://git.kernel.org/stable/c/28abce951343fcec26e397610868efa4e1395c3f
• https://git.kernel.org/stable/c/634f498ea5d5e8e01f8d9414d4f45eeaf9ee1996
• https://git.kernel.org/stable/c/abec577de5fc16cd5caae42f97cdcd0983c06d66
• https://git.kernel.org/stable/c/aec2c2ec87d4ec1f098979f68cd81b29f031c8cb
• https://git.kernel.org/stable/c/bed7fe3a936b6bdd84671385951397ca673cf6e7
• https://git.kernel.org/stable/c/dd8035dec26e98204d6e4a6e0cee5c4d329b3d7e
• https://git.kernel.org/stable/c/e542edada3f79387c0ac2a528cebf01f4ef47df8
• https://git.kernel.org/stable/c/e60159f5ea60254a5c3de4ea4f2f939f0171031b

• Type Confusion in Linux kernel hid driver
• Ubuntu update for linux-azure-fde
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx
• Ubuntu update for linux, linux-aws, linux-aws-5.15 and more