CVE-2026-43051: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: fix out-of-bounds read in wacomintuosbtirq
The wacomintuosbtirq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short report can trigger an out-of-bounds read when copying data into the wacom structure.
Specifically, report 0x03 requires at least 22 bytes to safely read the processed data and battery status, while report 0x04 (which falls through to 0x03) requires 32 bytes.
Add explicit length checks for these report IDs and log a warning if a short report is received.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
In wacom_intuos_bt_irq(), add explicit length checks for Bluetooth HID report ID 0x03 requiring at least 22 bytes and report ID 0x04 requiring at least 32 bytes, and log a warning when a short report is received.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43051?
CVE-2026-43051 has been classified as a medium severity vulnerability due to the potential for out-of-bounds read leading to information disclosure.
How do I fix CVE-2026-43051?
To address CVE-2026-43051, update your Linux kernel to the latest version that includes the patch for the wacom HID driver.
What systems are affected by CVE-2026-43051?
CVE-2026-43051 affects the Linux kernel specifically related to the wacom HID driver.
What is the impact of CVE-2026-43051?
The impact of CVE-2026-43051 includes possible information disclosure due to an out-of-bounds read in the wacom_intuos_bt_irq function.
Is CVE-2026-43051 being actively exploited?
As of now, there are no reported cases of CVE-2026-43051 being actively exploited in the wild.