CVE-2026-43047

HighCVSS 7.8/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: multitouch: Check to ensure report responses match the request

It is possible for a malicious (or clumsy) device to respond to a specific report's feature request using a completely different report ID. This can cause confusion in the HID core resulting in nasty side-effects such as OOB writes.

Add a check to ensure that the report ID in the response, matches the one that was requested. If it doesn't, omit reporting the raw event and return early.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787CWE-20

Affected software

VendorProductVersions
LinuxLinux>= 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095, < 516da3f25cfe18643835af1cf09b0e9ffc36c383; >= 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095, < a61163daf8a90b4a7ef154d5fc9c525f665734e3; >= 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095, < 74c6015375d8b9bc1b1eb79f20636c8e894bcad7; >= 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095, < c7a27bb4d0f6573ca0f9c7ef0b63291486239190; >= 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095, < 6a4acd3e86fe5584050c213d95147eba33856033; >= 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095, < 7f66fdbc077faed3b52519228d21d81979e92249; >= 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095, < 2edc92f89eee328b5be5706b5d431bf90669e9c0; >= 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095, < e716edafedad4952fe3a4a273d2e039a84e8681a; fee906f035f0bd18ff12d84d58766c44a2ab0918; >= 4.3.6, < 4.4
LinuxLinux4.4

References

Timeline

Published
May 1, 2026
Last modified
Nov 11, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-430488.8In the Linux kernel, the following vulnerability has been resolved: HID: core: Mitigate potential OOB by removing bogus memset() The memseCVE-2026-430497.8In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisCVE-2026-43056.1The Royal WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpr_pending_templaCVE-2026-430507.0In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix use-after-free in sock_def_readable() A race condition eCVE-2026-430518.1In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_inCVE-2026-430527.1In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check tdls flag in ieee80211_tdls_oper When NL80211_TDCVE-2026-430534.7In the Linux kernel, the following vulnerability has been resolved: xfs: close crash window in attr dabtree inactivation When inactivatingCVE-2026-430545.5In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcm_loop: Drain commands in target_reset handler tcm_looCVE-2026-430557.5In the Linux kernel, the following vulnerability has been resolved: scsi: target: file: Use kzalloc_flex for aio_cmd The target_core_file CVE-2026-430567.8In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in add_adev() error path If auxiliary_deCVE-2026-430577.5In the Linux kernel, the following vulnerability has been resolved: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback NETIFCVE-2026-430585.5In the Linux kernel, the following vulnerability has been resolved: media: vidtv: fix pass-by-value structs causing MSAN warnings vidtv_ts
CVE-2026-43047: High severity, CVSS 7.8 | Vulnix