A malicious HID device can send a specially crafted packet beginning with the DOUBLE_REPORT_ID 0xf7 and followed by zero bytes. The kernel driver processes this packet by recursively calling the same parsing routine on each half of the packet. Because the only check is a size < 1 test, the recursion depth is unbounded. For an incoming report of up to the maximum buffer size, the driver can generate roughly 8000 nested calls, quickly exhausting the 16 KiB kernel stack. This overflow triggers a kernel panic when virtual mapping is enabled or results in memory corruption otherwise. The outcome is a loss of system availability and memory corruption, without a stated escalation to higher privileges.

All variants of the Linux kernel that include the magicmouse HID driver are affected. No specific version information is provided, so any kernel containing this driver is vulnerable.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, yet the potential impact makes it a severe issue. An attacker would need to physically connect a crafted HID device to the target machine, making the attack vector local via USB or other HID interfaces that load the magicmouse driver. Once the exploit is triggered, the kernel will either panic or suffer memory corruption, enabling denial of service and possible arbitrary code execution at kernel level when the stack corruption propagates.