The Linux kernel’s Hyper‑V synthetic HID host sends SYNTH_HID_INITIAL_DEVICE_INFO messages that include a HID descriptor and report descriptor bytes. The function mousevsc_on_receive_device_info trusts the bLength and wDescriptorLength fields without ensuring that the received packet contains both ranges. If a host sends a short initial device‑info message with an oversized report descriptor length, the guest will read past the end of the packet while copying the descriptor, causing a guest crash. The weakness is an out‑of‑bounds read that can be triggered by malformed input from a malicious Hyper‑V host, leading to denial of service on the guest.

The vulnerability affects the Linux kernel on all supported distributions that use the Hyper‑V synthetic HID host driver. The affected component is the hyper‑V HID driver in the kernel. No specific kernel version or distribution is listed; any kernel that includes the unpatched mousevsc_on_receive_device_info function is potentially vulnerable until the fix is applied.

The CVSS score is not provided, and the EPSS score is unavailable, so the precise quantitative risk cannot be expressed. However, the vulnerability is exploitable by an adversary that controls a Hyper‑V host or backend, allowing them to trigger a guest crash. The attack does not require privilege escalation; a malicious host can send the crafted payload directly over VMBus. The lack of impact in the CISA KEV catalog suggests no publicly known exploits, but the severity of a denial of service to a virtual machine justifies immediate remediation.