CVE-2026-80783 Affecting kernel-livepatch-6_4_0-150700_53_90-default package, versions <1-150700.15.3.1


Severity

Recommended
0.0
medium
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.2% (10th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES157-KERNELLIVEPATCH6401507005390DEFAULT-22231483
  • published5 Nov 2026
  • disclosed3 Nov 2026

Introduced: 3 Nov 2026

NewCVE-2026-80783  (opens in a new tab)

How to fix?

Upgrade SLES:15.7 kernel-livepatch-6_4_0-150700_53_90-default to version 1-150700.15.3.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-livepatch-6_4_0-150700_53_90-default package and not the kernel-livepatch-6_4_0-150700_53_90-default package as distributed by SLES. See How to fix? for SLES:15.7 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()

magicmouse_raw_event() handles DOUBLE_REPORT_ID (0xf7) packets, which pack two touch reports into one, by splitting the packet and calling itself on each half. The only guard against runaway recursion is a "size < 1" check, which stops zero-sized calls but does not bound the recursion depth.

A malicious HID device that matches this driver can send a report starting with DOUBLE_REPORT_ID and filled with the sequence [0xf7, 0x00]. Each level consumes two bytes and recurses on the remainder, so an incoming report of up to HID_MAX_BUFFER_SIZE (16 KiB) drives roughly 8000 nested calls. That easily exhausts the 16 KiB kernel stack, leading to a stack overflow: a panic with CONFIG_VMAP_STACK, or memory corruption without it.

A double report only ever wraps two normal reports; it is never legitimately nested. Refuse to re-enter the DOUBLE_REPORT_ID case from a recursive call so the recursion depth is bounded to two, while all valid packets keep being parsed exactly as before.

CVSS Base Scores

version 3.1