CVE-2026-43047 Linux CVE debrief

Who should care

Linux system administrators and users of HID multitouch devices should assess exposure and apply patches to prevent potential out-of-bounds writes and system instability. Security teams should review the vulnerability and ensure that appropriate mitigations are in place for affected systems. Operators of Linux systems with HID multitouch devices connected should prioritize patching and monitoring to prevent exploitation.

Why it matters

A vulnerability in the Linux kernel's HID multitouch driver could allow a malicious device to cause confusion in the HID core, potentially leading to out-of-bounds writes. Linux system administrators and users of HID multitouch devices should assess exposure and apply patches.

• Verify patch application to prevent potential out-of-bounds writes
• Monitor for malicious device activity targeting HID multitouch devices
• Assess exposure of Linux systems using HID multitouch devices

Technical summary

The Linux kernel's HID multitouch driver is vulnerable to a malicious device responding to a specific report's feature request with a different report ID, potentially causing out-of-bounds writes. A check has been added to ensure report responses match the request, preventing such attacks. This patch does not address root causes but provides a critical fix to mitigate the vulnerability. Linux system administrators should prioritize patching to prevent potential exploitation and out-of-bounds writes that could compromise system stability.

Defensive priority

High-priority assessment and remediation recommended for Linux systems using HID multitouch devices.

Recommended defensive actions

• Assess exposure of Linux systems using HID multitouch devices
• Verify and apply patches from the Linux kernel Git repository
• Monitor for potential malicious device activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability and its resolution. Multiple source references from the Linux kernel Git repository are available, but specific reference details are not provided in the CVE record. The patch adds a report ID validation check to prevent out-of-bounds writes. Defenders should verify patch application and monitor for potential malicious device activity. The source confidence is high based on the Linux kernel Git repository references.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.