The bug originates in the Linux kernel's HID magicmouse driver when a fake USB device provides a report descriptor that bypasses the expected input_mapping hook. This leaves the internal msc->input pointer uninitialized and NULL. A subsequent use of this NULL pointer causes a kernel crash, resulting in a system reboot or loss of services. The failure manifests as a denial‑of‑service attack that disrupts system availability.

Any Linux system that runs a kernel containing the vulnerable HID magicmouse driver before the fix is applied is affected. This includes all mainstream distributions that ship unpatched kernel versions matching the commit that introduced the vulnerability. No specific sub‑version was identified, so any kernel build lacking the resolution commit may be susceptible.

Exploitation requires a USB device that masquerades as a Magic Mouse, making the attack vector the physical access to a USB port (or remote USB insertion if an attacker can insert the device). The vulnerability does not provide privilege escalation or information disclosure, but it can trigger a kernel crash that results in a denial of service. The CVSS score of 5.5 indicates a moderate severity impact. The EPSS score of 0.00032 (less than 0.1%) indicates a very low exploitation probability, and the flaw is not listed in the CISA KEV catalog, yet the potential for system disruption demands prompt remediation.