CVE-2026-43047 Details
Description
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Check to ensure report responses match the request It is possible for a malicious (or clumsy) device to respond to a specific report's feature request using a completely different report ID. This can cause confusion in the HID core resulting in nasty side-effects such as OOB writes. Add a check to ensure that the report ID in the response, matches the one that was requested. If it doesn't, omit reporting the raw event and return early.
A vulnerability in the Linux kernel's HID multitouch driver allows a device to respond to feature requests with incorrect report IDs. This mismatch can confuse the HID core, potentially leading to out-of-bounds writes. The issue has been addressed by adding a check to ensure the report ID in the response matches the requested ID. If there is a discrepancy, the raw event is not reported, and the function returns early.
Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version can be found on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/2edc92f89eee328b5be5706b5d431bf90669e9c0 | kernel.org | Patch |
| https://git.kernel.org/stable/c/516da3f25cfe18643835af1cf09b0e9ffc36c383 | kernel.org | Patch |
| https://git.kernel.org/stable/c/6a4acd3e86fe5584050c213d95147eba33856033 | kernel.org | Patch |
| https://git.kernel.org/stable/c/74c6015375d8b9bc1b1eb79f20636c8e894bcad7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/7f66fdbc077faed3b52519228d21d81979e92249 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a61163daf8a90b4a7ef154d5fc9c525f665734e3 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c7a27bb4d0f6573ca0f9c7ef0b63291486239190 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e716edafedad4952fe3a4a273d2e039a84e8681a | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.4, < 5.10.253 >= 5.11, < 5.15.203 >= 5.16, < 6.1.168 >= 6.2, < 6.6.134 >= 6.7, < 6.12.81 >= 6.13, < 6.18.22 >= 6.19, < 6.19.12 4.3.6 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 8, 2026 | Initial Analysis | [email protected] |
| May 3, 2026 | CVE Modified | kernel.org |
| May 1, 2026 | New CVE Received | kernel.org |