The Linux kernel’s Rapoo HID driver omitted a check to confirm a device’s USB ancestry before calling to_usb_interface(). The driver can be tricked into treating a non‑USB HID device—created via the uhid subsystem—as a USB device, resulting in an invalid memory access that causes a kernel splat. The flaw is localized to kernel space and can compel the system to crash, providing a denial of service that may also permit local privilege escalation if an attacker can induce the crash and subsequently gain elevated rights.

All Linux kernel installations that include the Rapoo HID driver prior to the advertised commit are affected. Because the advisory does not specify a version range, any kernel build that incorporates the unpatched driver may be vulnerable. Kernel versions updated with the commit that adds a hid_is_usb() check are not susceptible.

The CVSS score is not disclosed and the EPSS score is unavailable, so the precise likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA KEV catalog. The attack vector appears to be local; a malicious actor would need to create or manipulate a HID device via the uhid subsystem to trigger the fault. Successful exploitation results in a kernel crash and denial of service, with possible local privilege escalation depending on system configuration.