CVE-2026-43051 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of affected Linux kernel versions should assess exposure and prioritize patching. Linux kernel developers should review and apply patches to address the vulnerability. Linux distribution maintainers should update affected Linux kernel versions and verify bounds checking. Users of affected Linux kernel versions should prioritize patching and monitor for unusual HID report

Why it matters

CVE-2026-43051 is a HID wacom driver vulnerability in the Linux kernel that allows for out-of-bounds reads. Defenders should prioritize patching, monitor for unusual activity, and verify bounds checking.

• Verify and apply patches to prevent potential out-of-bounds reads
• Monitor system logs for warnings related to short HID reports
• Update affected Linux kernel versions to ensure bounds checking is performed

Technical summary

The wacom_intuos_bt_irq function in the Linux kernel does not perform sufficient bounds checking on Bluetooth HID reports. This can lead to an out-of-bounds read when processing short reports, specifically report IDs 0x03 and 0x04. The vulnerability is addressed through explicit length checks for these report IDs and logging warnings for short reports. The Linux kernel's HID wacom driver requires patching to address this issue, specifically by adding bounds checking to prevent out-of-bounds reads. Affected Linux kernel versions should be updated to ensure bounds checking is performed.

Defensive priority

Defenders should prioritize patching affected Linux kernel versions and monitor for unusual HID report activity.

Recommended defensive actions

• Patch affected Linux kernel versions with the provided commits
• Monitor HID report activity for unusual behavior
• Verify bounds checking for wacom_intuos_bt_irq function
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and associated source item provide details on the vulnerability. Seven source references are provided, detailing specific commits and patches addressing the issue. The Linux kernel's HID wacom driver is vulnerable to an out-of-bounds read. This issue arises from insufficient bounds checking in the wacom_intuos_bt_irq function. A maliciously crafted short report can trigger this vulnerability, specifically reports 0x03 and 0x04 require at least 22 and 32 bytes respectively to safely read data. Defenders should verify and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.