CVE-2026-43140

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A crash can occur when fake USB devices impersonating a magic mouse send their own report descriptors. This prevents the input mapping() hook from being called, leaving the msc->input variable as NULL. The issue is triggered when the system later attempts to access this NULL variable. The fix involves detecting this condition within the input configured() hook to reject the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.