CVE-2026-43051 Details
Description
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short report can trigger an out-of-bounds read when copying data into the wacom structure. Specifically, report 0x03 requires at least 22 bytes to safely read the processed data and battery status, while report 0x04 (which falls through to 0x03) requires 32 bytes. Add explicit length checks for these report IDs and log a warning if a short report is received.
A vulnerability has been identified in the Linux kernel's handling of Bluetooth HID reports for Wacom Intuos tablets. The issue arises in the 'wacom_intuos_bt_irq()' function, which processes HID reports without adequate bounds checking. This flaw can lead to an out-of-bounds read when data is copied into the Wacom structure, potentially allowing for memory corruption or other unintended behavior. Specifically, report 0x03 requires a minimum of 22 bytes to safely read the data and battery status, while report 0x04 (which falls through to 0x03) requires 32 bytes. The vulnerability affects several versions of the Linux kernel.
Users can update to the latest version of the Linux kernel, where this vulnerability has been addressed. Instructions for updating the kernel can be found in the documentation for your specific Linux distribution.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/2f1763f62909ccb6386ac50350fa0abbf5bb16a9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/3d78386b144453c47e81bf62dc3601b757f02d99 | kernel.org | Patch |
| https://git.kernel.org/stable/c/41026bcc0fdf82605205c27935ef719cbc07193b | kernel.org | Patch |
| https://git.kernel.org/stable/c/5b5b9730111808410e404ceac2fabd32eef92fbd | kernel.org | Patch |
| https://git.kernel.org/stable/c/8bd690ac1242332c73cba10dacdad6c6642bbb94 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c8dc23c97680eebefde06da5858aaef1b37cf75d | kernel.org | Patch |
| https://git.kernel.org/stable/c/d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada | kernel.org | Patch |
| https://git.kernel.org/stable/c/fa8901cb1f0b2113a342db93bd5684b59fe99dcf | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 3.3, < 5.10.253 >= 5.11, < 5.15.203 >= 5.16, < 6.1.168 >= 6.2, < 6.6.134 >= 6.7, < 6.12.81 >= 6.13, < 6.18.22 >= 6.19, < 6.19.12 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 7, 2026 | Initial Analysis | [email protected] |
| May 3, 2026 | CVE Modified | kernel.org |
| May 1, 2026 | New CVE Received | kernel.org |