The bug originates in the Linux kernel' HID magicmouse driver when a fake USB device provides a report descriptor that bypasses the expected input_mapping hook. This leaves the internal msc->input pointer uninitialised and NULL. A subsequent use of this NULL pointer causes a kernel crash, resulting in a system reboot or loss of services. The failure manifests as a denial‑of‑service attack that disrupts system availability.

Any Linux system that runs a kernel containing the vulnerable HID magicmouse driver before the fix is applied is affected. This includes all mainstream distributions that ship unpatched kernel versions matching the commit that introduced the vulnerability. No specific sub‑version was identified, so any kernel build lacking the resolution commit may be susceptible.

Exploitation requires a USB device that can masquerade as a Magic Mouse, so the attack vector is physical access to a USB port (or remote USB insertion if the attacker can access the physical device). The vulnerability does not grant privilege escalation or information disclosure, but it can trigger a kernel panic, causing a denial of service. Because the EPSS score is missing and the flaw is not listed in CISA KEV, the exact likelihood of exploitation is unclear, yet the potential impact warrants prompt correction.