The vulnerability arises when the magicmouse_report_fixup() function in the Linux kernel allocates a buffer with kmemdup() but never frees it. As a result, each invocation that triggers the function creates a memory leak. Repeated use of the magicmouse HID device can accumulate unreclaimed memory until the system exhausts available memory resources, potentially causing system slowdown or crashes—an indirect denial‑of‑service condition. The underlying weakness is a classic memory‑leak defect.

All Linux kernel users are potentially affected, since the vendor list identifies Linux kernels broadly and no specific version range is noted. The issue exists in any kernel build prior to the inclusion of the patch that addresses the leak in magicmouse_report_fixup().

The risk is elevated because each use of the magicmouse HID can increase memory consumption. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Affected systems that allow continuous HID magicmouse activity—such as kiosk machines or routers exposing USB ports—should be promptly updated. The CVSS score is 5.5.