LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47120: HID: magicmouse: fix NULL-deref on disconnect

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: fix NULL-deref on disconnect Commit 9d7b18668956 ("HID: magicmouse: add support for Apple Magic Trackpad 2") added a sanity check for an Apple trackpad but returned success instead of -ENODEV when the check failed. This means that the remove callback will dereference the never-initialised driver data pointer when the driver is later unbound (e.g. on USB disconnect).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2021-47120 is a Linux kernel bug in the Apple Magic Trackpad 2 support path. Under a failed device sanity check, later device removal can dereference uninitialized driver data and crash the kernel. The business impact is mainly endpoint or workstation availability, not confirmed data theft or remote compromise.

Executive priority

Handle through normal Linux endpoint patching, with priority for workstations using Apple peripherals. There is no source-backed evidence of active exploitation or broad remote exposure, but kernel crashes can still disrupt users and support operations.

Technical view

The HID magicmouse driver returned success instead of -ENODEV when a trackpad sanity check failed. That left driver data uninitialized, so the remove callback could NULL-dereference it during later unbind or USB disconnect. Stable kernel commits are listed as fixes; no CVSS, CWE, or active exploitation evidence is provided.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions with the HID magicmouse Apple trackpad support path in use. Workstations using Apple Magic Trackpad 2-class peripherals are more plausible targets than servers. Version data in the bundle is incomplete and should be verified against distribution kernels.

Exploitation context

The source describes a crash condition on device unbind or disconnect after a failed sanity check. The bundle marks KEV as false and provides no cited evidence of exploitation in the wild. Treat this as a denial-of-service style kernel stability issue unless vendor advisories indicate otherwise.

Researcher notes

The key defect is incorrect success return handling after a failed sanity check, creating uninitialized driver data consumed by the remove callback. The provided affected-version list is sparse and duplicated, so distro backport mapping is necessary before declaring systems exposed or remediated.

Mitigation direction

  • Update affected Linux kernels to versions containing the stable magicmouse fix.
  • Check Linux distribution advisories for backported patches and exact package versions.
  • Prioritize patched kernels on workstations using Apple Magic Trackpad 2 peripherals.
  • If patching is delayed, review vendor guidance for temporary device or driver restrictions.

Validation and detection

  • Inventory Linux kernel versions on endpoints and developer workstations.
  • Identify systems using Apple Magic Trackpad 2 or the HID magicmouse driver.
  • Compare installed kernels with distribution advisories and listed stable fix commits.
  • Confirm patched systems no longer run affected kernel builds.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47120 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9d7b18668956c411a422d04c712994c5fdb23a4b, 9d7b18668956c411a422d04c712994c5fdb23a4b, 9d7b18668956c411a422d04c712994c5fdb23a4b, 9d7b18668956c411a422d04c712994c5fdb23a4bunaffected
LinuxLinux4.20, 0, 5.4.125, 5.10.43, 5.12.10, 5.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.