CVE-2026-43051
published 2026-05-01CVE-2026-43051: In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq()…
PriorityP340high8.1CVSS 3.1
AVAACLPRNUINSUCHINAH
EPSS
0.26%
16.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
The wacom_intuos_bt_irq() function processes Bluetooth HID reports
without sufficient bounds checking. A maliciously crafted short report
can trigger an out-of-bounds read when copying data into the wacom
structure.
Specifically, report 0x03 requires at least 22 bytes to safely read
the processed data and battery status, while report 0x04 (which
falls through to 0x03) requires 32 bytes.
Add explicit length checks for these report IDs and log a warning if
a short report is received.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a < d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada | d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada |
| linux | linux | >= 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a < 5b5b9730111808410e404ceac2fabd32eef92fbd | 5b5b9730111808410e404ceac2fabd32eef92fbd |
| linux | linux | >= 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a < fa8901cb1f0b2113a342db93bd5684b59fe99dcf | fa8901cb1f0b2113a342db93bd5684b59fe99dcf |
| linux | linux | >= 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a < 8bd690ac1242332c73cba10dacdad6c6642bbb94 | 8bd690ac1242332c73cba10dacdad6c6642bbb94 |
| linux | linux | >= 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a < 41026bcc0fdf82605205c27935ef719cbc07193b | 41026bcc0fdf82605205c27935ef719cbc07193b |
| linux | linux | >= 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a < c8dc23c97680eebefde06da5858aaef1b37cf75d | c8dc23c97680eebefde06da5858aaef1b37cf75d |
| linux | linux | >= 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a < 3d78386b144453c47e81bf62dc3601b757f02d99 | 3d78386b144453c47e81bf62dc3601b757f02d99 |
| linux | linux | >= 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a < 2f1763f62909ccb6386ac50350fa0abbf5bb16a9 | 2f1763f62909ccb6386ac50350fa0abbf5bb16a9 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 3.3 < 5.10.253 | 5.10.253 |
| linux | linux_kernel | >= 5.11 < 5.15.203 | 5.15.203 |
| linux | linux_kernel | >= 5.16 < 6.1.168 | 6.1.168 |
| linux | linux_kernel | >= 6.13 < 6.18.22 | 6.18.22 |
| linux | linux_kernel | >= 6.19 < 6.19.12 | 6.19.12 |
| linux | linux_kernel | >= 6.2 < 6.6.134 | 6.6.134 |
| linux | linux_kernel | >= 6.7 < 6.12.81 | 6.12.81 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
vendor_redhat·2026-05-01·CVSS 7.0
CVE-2026-43051 [HIGH] CWE-125 kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
A flaw was found in the Linux kernel's Wacom Human Interface Device (HID) driver. This vulnerability allows a remote attacker to trigger an out-of-bounds read by sending a specially crafted, short Bluetooth HID report. This can lead to the disclosure of sensitive information from the system's memory.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Affected
Package: kernel (Red Hat Enterprise Linux 8) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Affected
Package: kernel (Red Hat Enterprise Linux 9) - Affected
Package: kernel-rt (
VulDB
Linux Kernel up to 6.19.11 wacom_intuos_bt_irq out-of-bounds
vuldb·2026-05-01
CVE-2026-43051 [LOW] Linux Kernel up to 6.19.11 wacom_intuos_bt_irq out-of-bounds
A vulnerability was found in Linux Kernel up to 6.19.11 and classified as critical. Impacted is the function wacom_intuos_bt_irq. Such manipulation leads to out-of-bounds read.
This vulnerability is listed as CVE-2026-43051. The attack must be carried out from within the local network. There is no available exploit.
It is suggested to upgrade the affected component.
GHSA
GHSA-4mjh-m2x6-5qg4: In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
The wacom_intuos_bt_ir
ghsa_unreviewed·2026-05-01
CVE-2026-43051 [HIGH] GHSA-4mjh-m2x6-5qg4: In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
The wacom_intuos_bt_ir
In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
The wacom_intuos_bt_irq() function processes Bluetooth HID reports
without sufficient bounds checking. A maliciously crafted short report
can trigger an out-of-bounds read when copying data into the wacom
structure.
Specifically, report 0x03 requires at least 22 bytes to safely read
the processed data and battery status, while report 0x04 (which
falls through to 0x03) requires 32 bytes.
Add explicit length checks for these report IDs and log a warning if
a short report is received.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/2f1763f62909ccb6386ac50350fa0abbf5bb16a9https://git.kernel.org/stable/c/3d78386b144453c47e81bf62dc3601b757f02d99https://git.kernel.org/stable/c/41026bcc0fdf82605205c27935ef719cbc07193bhttps://git.kernel.org/stable/c/5b5b9730111808410e404ceac2fabd32eef92fbdhttps://git.kernel.org/stable/c/8bd690ac1242332c73cba10dacdad6c6642bbb94https://git.kernel.org/stable/c/c8dc23c97680eebefde06da5858aaef1b37cf75dhttps://git.kernel.org/stable/c/d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aadahttps://git.kernel.org/stable/c/fa8901cb1f0b2113a342db93bd5684b59fe99dcf
2026-05-01
Published