CVE-2026-43051
Description
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short report can trigger an out-of-bounds read when copying data into the wacom structure. Specifically, report 0x03 requires at least 22 bytes to safely read the processed data and battery status, while report 0x04 (which falls through to 0x03) requires 32 bytes. Add explicit length checks for these report IDs and log a warning if a short report is received.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
Description kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq Red Hat statement A Bluetooth HID report parsing bug in the Wacom driver can cause an out of bounds read in wacom_intuos_bt_irq. Report 0x03 needs at least 22 bytes and report 0x04 needs 32 bytes because it falls through into the 0x03 handling path, but the old code processed shorter reports without validating these…
Description
kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
Red Hat statement
A Bluetooth HID report parsing bug in the Wacom driver can cause an out of bounds read in wacom_intuos_bt_irq. Report 0x03 needs at least 22 bytes and report 0x04 needs 32 bytes because it falls through into the 0x03 handling path, but the old code processed shorter reports without validating these lengths. A malicious or compromised Bluetooth HID device can send a crafted short report and make the kernel read past the received report buffer while updating Wacom input or battery state. For the CVSS the PR:N is used in the paranoid score because the attacker only needs Bluetooth device control and does not need a local account on the victim. The issue is adjacent network reachable over Bluetooth rather than Internet reachable.
CVSS v3: 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Errata / fixed releases
| Product | Package | Advisory | Released |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel-0:6.12.0-211.18.1.el10_2 | RHSA-2026:21557 | 2026-05-28T00:00:00Z |
| Red Hat Enterprise Linux 9 | kernel-0:5.14.0-687.12.1.el9_8 | RHSA-2026:21556 | 2026-05-28T00:00:00Z |
| Red Hat Enterprise Linux 9 | kernel-0:5.14.0-687.12.1.el9_8 | RHSA-2026:21556 | 2026-05-28T00:00:00Z |
Package state
| Product | Package | State |
|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected |
| Red Hat Enterprise Linux 7 | kernel | Affected |
| Red Hat Enterprise Linux 7 | kernel-rt | Affected |
| Red Hat Enterprise Linux 8 | kernel | Affected |
| Red Hat Enterprise Linux 8 | kernel-rt | Affected |
| Red Hat Enterprise Linux 9 | kernel-rt | Affected |
Apply commands
yum update -y kernel
# or:
dnf upgrade -y kernelAffected
| Vendor | Product | Version |
|---|---|---|
| redhat | Red Hat Enterprise Linux 6 | Not affected |
| redhat | Red Hat Enterprise Linux 7 | Affected |
| redhat | Red Hat Enterprise Linux 7 | Affected |
| redhat | Red Hat Enterprise Linux 8 | Affected |
| redhat | Red Hat Enterprise Linux 8 | Affected |
| redhat | Red Hat Enterprise Linux 9 | Affected |
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| rhel | 9 | fixed | |
| debian | bookworm | fixed | 6.1.170-1 |
| debian | bullseye | fixed | 6.1.170-1~deb11u1 |
| debian | forky | fixed | 6.19.12-1 |
| debian | sid | fixed | 6.19.12-1 |
| debian | trixie | fixed | 6.12.85-1 |
| linux-kernel | affected | 5.10.253 | |
| linux-kernel | 7.0 | affected | |
| almalinux | 8 | fixed | kernel-doc-4.18.0-553.126.1.el8_10.noarch.rpm |
References
- https://git.kernel.org/stable/c/2f1763f62909ccb6386ac50350fa0abbf5bb16a9
- https://git.kernel.org/stable/c/3d78386b144453c47e81bf62dc3601b757f02d99
- https://git.kernel.org/stable/c/41026bcc0fdf82605205c27935ef719cbc07193b
- https://git.kernel.org/stable/c/5b5b9730111808410e404ceac2fabd32eef92fbd
- https://git.kernel.org/stable/c/8bd690ac1242332c73cba10dacdad6c6642bbb94
- https://git.kernel.org/stable/c/c8dc23c97680eebefde06da5858aaef1b37cf75d
- https://git.kernel.org/stable/c/d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada
- https://git.kernel.org/stable/c/fa8901cb1f0b2113a342db93bd5684b59fe99dcf
- https://www.suse.com/security/cve/CVE-2026-43051.html
- https://security-tracker.debian.org/tracker/CVE-2026-43051
- https://access.redhat.com/errata/RHSA-2026:21556
- https://access.redhat.com/errata/RHSA-2026:21706
- https://bugzilla.redhat.com/2404105
- https://bugzilla.redhat.com/2422699
- https://bugzilla.redhat.com/2424879
- https://bugzilla.redhat.com/2429602
- https://bugzilla.redhat.com/2448594
- https://bugzilla.redhat.com/2448745
- https://bugzilla.redhat.com/2454810
- https://bugzilla.redhat.com/2455334
- https://bugzilla.redhat.com/2461107
- https://bugzilla.redhat.com/2461757
- https://bugzilla.redhat.com/2461759
- https://bugzilla.redhat.com/2464369
- https://bugzilla.redhat.com/2464455
CWEs
CWE-125
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.