CVE-2026-80774

Name	CVE-2026-80774
Description	In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't actually have a USB parent. Fix the use of to_usb_interface() without a hid_is_usb() check. I have verified that it is currently possible to trigger a kernel splat due to this bug in an ASAN build, and that this commit fixes the issue.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux (PTS)	bookworm	6.1.176-1	fixed
	bookworm (security)	6.1.187-1	fixed
	trixie, trixie (security)	6.12.107-1	vulnerable
	forky	7.2.6-1	fixed
	sid	7.2.7-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
linux	source	bookworm	(not affected)
linux	source	(unstable)	7.1.12-1

[bookworm] - linux <not-affected> (Vulnerable code not present)
https://git.kernel.org/linus/02bf61dfb44f17ec187d1da1a82495951bbd12df (7.3-rc1)