{"id":"CVE-2026-43051","revision":"05e3e90bedd44c2aaca6e3fe5ee87beb","records":[{"revision":"05e3e90bedd44c2aaca6e3fe5ee87beb","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-43051","aliases":[],"title":"HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq\n\nThe wacom_intuos_bt_irq() function processes Bluetooth HID reports\nwithout sufficient bounds checking. A maliciously crafted short report\ncan trigger an out-of-bounds read when copying data into the wacom\nstructure.\n\nSpecifically, report 0x03 requires at least 22 bytes to safely read\nthe processed data and battery status, while report 0x04 (which\nfalls through to 0x03) requires 32 bytes.\n\nAdd explicit length checks for these report IDs and log a warning if\na short report is received.","state":0,"publishedAt":"2026-05-01T14:15:45.314+00:00","modifiedAt":"2026-10-19T19:06:11.476+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/hid/wacom_wac.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a\",\n                            \"lessThan\": \"d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a\",\n                            \"lessThan\": \"5b5b9730111808410e404ceac2fabd32eef92fbd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a\",\n                            \"lessThan\": \"fa8901cb1f0b2113a342db93bd5684b59fe99dcf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a\",\n                            \"lessThan\": \"8bd690ac1242332c73cba10dacdad6c6642bbb94\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a\",\n                            \"lessThan\": \"41026bcc0fdf82605205c27935ef719cbc07193b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a\",\n                            \"lessThan\": \"c8dc23c97680eebefde06da5858aaef1b37cf75d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a\",\n                            \"lessThan\": \"3d78386b144453c47e81bf62dc3601b757f02d99\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a\",\n                            \"lessThan\": \"2f1763f62909ccb6386ac50350fa0abbf5bb16a9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/hid/wacom_wac.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.253\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.203\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.168\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.134\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.81\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.22\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.12\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","score":8.1,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada","https://git.kernel.org/stable/c/5b5b9730111808410e404ceac2fabd32eef92fbd","https://git.kernel.org/stable/c/fa8901cb1f0b2113a342db93bd5684b59fe99dcf","https://git.kernel.org/stable/c/8bd690ac1242332c73cba10dacdad6c6642bbb94","https://git.kernel.org/stable/c/41026bcc0fdf82605205c27935ef719cbc07193b","https://git.kernel.org/stable/c/c8dc23c97680eebefde06da5858aaef1b37cf75d","https://git.kernel.org/stable/c/3d78386b144453c47e81bf62dc3601b757f02d99","https://git.kernel.org/stable/c/2f1763f62909ccb6386ac50350fa0abbf5bb16a9"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43051","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-43051","identifiers":["CVE-2026-43051"]},"retained":false,"historicalAffected":[]}],"coverage":[]}