CVE-2026-43051 HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
A maliciously crafted Bluetooth HID report can trigger an out-of-bounds read in the Linux kernel's Wacom driver, potentially causing a crash or leaking memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43051?
CVE-2026-43051 is a high-severity memory corruption vulnerability in Linux kernel, published on 1 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short report can trigger an out-of-bounds read when copying data into the wacom structure.
Specifically, report 0x03 requires at least 22 bytes to safely read the processed data and battery status, while report 0x04 (which falls through to 0x03) requires 32 bytes.
Add explicit length checks for these report IDs and log a warning if a short report is received.
Weakness: CWE-125
Which versions are affected by CVE-2026-43051?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43051?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-43051 being exploited?
There is no known exploitation of CVE-2026-43051 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43051, DEBIAN-CVE-2026-43051, GHSA-4mjh-m2x6-5qg4, ROOT-OS-DEBIAN-11-CVE-2026-43051, ROOT-OS-UBUNTU-2204-CVE-2026-43051, ROOT-OS-UBUNTU-2404-CVE-2026-43051 and 1 more.