In the Linux kernel's magicmouse HID driver, the device input descriptor is cached during parsing and later used as proof that an input device was registered. If the underlying hid‑input connection fails, the cached input device pointer is freed but the driver still believes it is valid. Subsequent input reports dereference this freed memory, creating a use‑after‑free condition that can lead to memory corruption, kernel panic or other uncontrolled behavior. The vulnerability stems from inadequate null checking and stale pointer retention after a failed input connection.

All Linux kernel builds that contain the magicmouse HID driver are affected, as the kernel version information is not specified in the advisory. The issue is present in any Linux kernel that has not been patched to clear the stale msc->input pointer after a failed hid‑input connection.

The CVSS score is not provided and EPSS is unavailable, so the quantified risk level cannot be rigorously determined. The vulnerability remains in the kernel’s code paths that process input reports from devices such as the USB Magic Mouse 2 or Magic Trackpad 2, which could be accessed by an attacker using a malicious USB or Bluetooth HID device. The lack of a sanitizing null check and the potential for memory corruption give this flaw a non‑negligible risk of exploitation, but the absence of a public exploit and no listing in CISA’s KEV catalog suggest that the current threat level may be moderate until a proof‑of‑concept is discovered.