{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43051", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.980Z", "datePublished": "2026-05-01T14:15:45.314Z", "dateUpdated": "2026-08-05T12:25:34.976Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:34.976Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq\n\nThe wacom_intuos_bt_irq() function processes Bluetooth HID reports\nwithout sufficient bounds checking. A maliciously crafted short report\ncan trigger an out-of-bounds read when copying data into the wacom\nstructure.\n\nSpecifically, report 0x03 requires at least 22 bytes to safely read\nthe processed data and battery status, while report 0x04 (which\nfalls through to 0x03) requires 32 bytes.\n\nAdd explicit length checks for these report IDs and log a warning if\na short report is received." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The vulnerable handler processes Bluetooth HID input reports from Wacom Intuos wireless devices, so an attacker must be within Bluetooth radio range or control a Bluetooth HID peripheral.\nAC:L - The attacker directly controls the report ID and report length; a short 0x03 or 0x04 report deterministically reaches the missing bounds checks once the HIDP session exists.\nPR:N - The attacker is the Bluetooth HID peer sending input reports and needs no local kernel privileges. The local HIDP setup path uses CAP_NET_ADMIN, but that is a host-side management gate, not a privilege required by the remote reporting device.\nUI:N - No victim action is needed to trigger the bug after the malicious or compromised Bluetooth HID device is connected; it can send the crafted input report on its own.\nS:U - The vulnerable Wacom HID driver and the impacted kernel/input state are under the same host kernel security authority.\nC:H - The bug reads beyond a kmemdup() report buffer and copies adjacent kernel heap bytes into Wacom report processing state. Because this is a kernel heap out-of-bounds read of up to the 32-byte report window, high confidentiality impact is the highest defensible assessment.\nI:N - The defect is an out-of-bounds read, not an out-of-bounds write or use-after-free, and it does not provide an attacker-controlled kernel memory modification primitive.\nA:H - Malformed short reports can repeatedly trigger kernel out-of-bounds reads; on hardened/debug configurations this is a KASAN-detected kernel fault, and on production systems it is defensible to treat repeated invalid kernel memory access as a potential crash." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/hid/wacom_wac.c" ], "versions": [ { "version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a", "lessThan": "d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada", "status": "affected", "versionType": "git" }, { "version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a", "lessThan": "5b5b9730111808410e404ceac2fabd32eef92fbd", "status": "affected", "versionType": "git" }, { "version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a", "lessThan": "fa8901cb1f0b2113a342db93bd5684b59fe99dcf", "status": "affected", "versionType": "git" }, { "version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a", "lessThan": "8bd690ac1242332c73cba10dacdad6c6642bbb94", "status": "affected", "versionType": "git" }, { "version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a", "lessThan": "41026bcc0fdf82605205c27935ef719cbc07193b", "status": "affected", "versionType": "git" }, { "version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a", "lessThan": "c8dc23c97680eebefde06da5858aaef1b37cf75d", "status": "affected", "versionType": "git" }, { "version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a", "lessThan": "3d78386b144453c47e81bf62dc3601b757f02d99", "status": "affected", "versionType": "git" }, { "version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a", "lessThan": "2f1763f62909ccb6386ac50350fa0abbf5bb16a9", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/hid/wacom_wac.c" ], "versions": [ { "version": "3.3", "status": "affected" }, { "version": "0", "lessThan": "3.3", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.134", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.81", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "5.10.253" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "5.15.203" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.1.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.6.134" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.12.81" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.18.22" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.19.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada" }, { "url": "https://git.kernel.org/stable/c/5b5b9730111808410e404ceac2fabd32eef92fbd" }, { "url": "https://git.kernel.org/stable/c/fa8901cb1f0b2113a342db93bd5684b59fe99dcf" }, { "url": "https://git.kernel.org/stable/c/8bd690ac1242332c73cba10dacdad6c6642bbb94" }, { "url": "https://git.kernel.org/stable/c/41026bcc0fdf82605205c27935ef719cbc07193b" }, { "url": "https://git.kernel.org/stable/c/c8dc23c97680eebefde06da5858aaef1b37cf75d" }, { "url": "https://git.kernel.org/stable/c/3d78386b144453c47e81bf62dc3601b757f02d99" }, { "url": "https://git.kernel.org/stable/c/2f1763f62909ccb6386ac50350fa0abbf5bb16a9" } ], "title": "HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq", "x_generator": { "engine": "bippy-1.2.0" } } } }