CVE-2026-43047

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43047", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.979Z", "datePublished": "2026-05-01T14:15:42.562Z", "dateUpdated": "2026-10-19T19:06:11.151Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:32.795Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: Check to ensure report responses match the request\n\nIt is possible for a malicious (or clumsy) device to respond to a\nspecific report's feature request using a completely different report\nID. This can cause confusion in the HID core resulting in nasty\nside-effects such as OOB writes.\n\nAdd a check to ensure that the report ID in the response, matches the\none that was requested. If it doesn't, omit reporting the raw event and\nreturn early."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reachable by a local process through /dev/uhid by creating a synthetic HID multitouch device and replying to the kernel's UHID_GET_REPORT with a mismatched report ID. Malicious physical HID devices can also trigger it, but UHID provides a higher-severity local device-file path.\nAC:L - The attacker controls the HID report descriptor and the feature-report response contents, and the bug is triggered deterministically during probe/open/resume feature fetching. There is no race or condition outside the attacker's control.\nPR:L - The local UHID path requires only access to the UHID character device as a low-privileged local user or permitted device group member. The kernel UHID create/reply path has no capable() gate requiring real root.\nUI:N - A local UHID attacker can create the virtual device and answer the kernel's GET_REPORT request directly. No separate victim action is required.\nS:U - The corruption occurs within the kernel HID/HID-core processing context and affects the same kernel security authority. It is not a VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The fix commit states that the mismatched report response can lead to HID-core confusion with out-of-bounds writes. Kernel memory corruption is reasonably capable of producing arbitrary information disclosure primitives.\nI:H - An out-of-bounds write in kernel memory is high-integrity impact because it can corrupt kernel objects and plausibly be developed into control-flow hijack or privilege escalation. When uncertain, the higher severity is appropriate.\nA:H - The same kernel memory corruption can crash or panic the kernel during HID report processing. Even without full exploitation, repeated triggering can cause high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hid/hid-multitouch.c"], "versions": [{"version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "lessThan": "516da3f25cfe18643835af1cf09b0e9ffc36c383", "status": "affected", "versionType": "git"}, {"version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "lessThan": "a61163daf8a90b4a7ef154d5fc9c525f665734e3", "status": "affected", "versionType": "git"}, {"version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "lessThan": "74c6015375d8b9bc1b1eb79f20636c8e894bcad7", "status": "affected", "versionType": "git"}, {"version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "lessThan": "c7a27bb4d0f6573ca0f9c7ef0b63291486239190", "status": "affected", "versionType": "git"}, {"version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "lessThan": "6a4acd3e86fe5584050c213d95147eba33856033", "status": "affected", "versionType": "git"}, {"version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "lessThan": "7f66fdbc077faed3b52519228d21d81979e92249", "status": "affected", "versionType": "git"}, {"version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "lessThan": "2edc92f89eee328b5be5706b5d431bf90669e9c0", "status": "affected", "versionType": "git"}, {"version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "lessThan": "e716edafedad4952fe3a4a273d2e039a84e8681a", "status": "affected", "versionType": "git"}, {"version": "fee906f035f0bd18ff12d84d58766c44a2ab0918", "status": "affected", "versionType": "git"}, {"version": "4.3.6", "lessThan": "4.4", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hid/hid-multitouch.c"], "versions": [{"version": "4.4", "status": "affected"}, {"version": "0", "lessThan": "4.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.134", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.81", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.1.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.6.134"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.12.81"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.18.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.19.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/516da3f25cfe18643835af1cf09b0e9ffc36c383"}, {"url": "https://git.kernel.org/stable/c/a61163daf8a90b4a7ef154d5fc9c525f665734e3"}, {"url": "https://git.kernel.org/stable/c/74c6015375d8b9bc1b1eb79f20636c8e894bcad7"}, {"url": "https://git.kernel.org/stable/c/c7a27bb4d0f6573ca0f9c7ef0b63291486239190"}, {"url": "https://git.kernel.org/stable/c/6a4acd3e86fe5584050c213d95147eba33856033"}, {"url": "https://git.kernel.org/stable/c/7f66fdbc077faed3b52519228d21d81979e92249"}, {"url": "https://git.kernel.org/stable/c/2edc92f89eee328b5be5706b5d431bf90669e9c0"}, {"url": "https://git.kernel.org/stable/c/e716edafedad4952fe3a4a273d2e039a84e8681a"}], "title": "HID: multitouch: Check to ensure report responses match the request", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43047", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:13:55.670356Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:06:11.151Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43047", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:13:55.670356Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:13:56.211Z"}}], "cna": {"title": "HID: multitouch: Check to ensure report responses match the request", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reachable by a local process through /dev/uhid by creating a synthetic HID multitouch device and replying to the kernel's UHID_GET_REPORT with a mismatched report ID. Malicious physical HID devices can also trigger it, but UHID provides a higher-severity local device-file path.\nAC:L - The attacker controls the HID report descriptor and the feature-report response contents, and the bug is triggered deterministically during probe/open/resume feature fetching. There is no race or condition outside the attacker's control.\nPR:L - The local UHID path requires only access to the UHID character device as a low-privileged local user or permitted device group member. The kernel UHID create/reply path has no capable() gate requiring real root.\nUI:N - A local UHID attacker can create the virtual device and answer the kernel's GET_REPORT request directly. No separate victim action is required.\nS:U - The corruption occurs within the kernel HID/HID-core processing context and affects the same kernel security authority. It is not a VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The fix commit states that the mismatched report response can lead to HID-core confusion with out-of-bounds writes. Kernel memory corruption is reasonably capable of producing arbitrary information disclosure primitives.\nI:H - An out-of-bounds write in kernel memory is high-integrity impact because it can corrupt kernel objects and plausibly be developed into control-flow hijack or privilege escalation. When uncertain, the higher severity is appropriate.\nA:H - The same kernel memory corruption can crash or panic the kernel during HID report processing. Even without full exploitation, repeated triggering can cause high availability impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "lessThan": "516da3f25cfe18643835af1cf09b0e9ffc36c383", "versionType": "git"}, {"status": "affected", "version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "lessThan": "a61163daf8a90b4a7ef154d5fc9c525f665734e3", "versionType": "git"}, {"status": "affected", "version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "lessThan": "74c6015375d8b9bc1b1eb79f20636c8e894bcad7", "versionType": "git"}, {"status": "affected", "version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "lessThan": "c7a27bb4d0f6573ca0f9c7ef0b63291486239190", "versionType": "git"}, {"status": "affected", "version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "lessThan": "6a4acd3e86fe5584050c213d95147eba33856033", "versionType": "git"}, {"status": "affected", "version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "lessThan": "7f66fdbc077faed3b52519228d21d81979e92249", "versionType": "git"}, {"status": "affected", "version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "lessThan": "2edc92f89eee328b5be5706b5d431bf90669e9c0", "versionType": "git"}, {"status": "affected", "version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "lessThan": "e716edafedad4952fe3a4a273d2e039a84e8681a", "versionType": "git"}, {"status": "affected", "version": "fee906f035f0bd18ff12d84d58766c44a2ab0918", "versionType": "git"}, {"status": "affected", "version": "4.3.6", "lessThan": "4.4", "versionType": "semver"}], "programFiles": ["drivers/hid/hid-multitouch.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.4"}, {"status": "unaffected", "version": "0", "lessThan": "4.4", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.253", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.168", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.134", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.81", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.22", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.12", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/hid/hid-multitouch.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/516da3f25cfe18643835af1cf09b0e9ffc36c383"}, {"url": "https://git.kernel.org/stable/c/a61163daf8a90b4a7ef154d5fc9c525f665734e3"}, {"url": "https://git.kernel.org/stable/c/74c6015375d8b9bc1b1eb79f20636c8e894bcad7"}, {"url": "https://git.kernel.org/stable/c/c7a27bb4d0f6573ca0f9c7ef0b63291486239190"}, {"url": "https://git.kernel.org/stable/c/6a4acd3e86fe5584050c213d95147eba33856033"}, {"url": "https://git.kernel.org/stable/c/7f66fdbc077faed3b52519228d21d81979e92249"}, {"url": "https://git.kernel.org/stable/c/2edc92f89eee328b5be5706b5d431bf90669e9c0"}, {"url": "https://git.kernel.org/stable/c/e716edafedad4952fe3a4a273d2e039a84e8681a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: Check to ensure report responses match the request\n\nIt is possible for a malicious (or clumsy) device to respond to a\nspecific report's feature request using a completely different report\nID. This can cause confusion in the HID core resulting in nasty\nside-effects such as OOB writes.\n\nAdd a check to ensure that the report ID in the response, matches the\none that was requested. If it doesn't, omit reporting the raw event and\nreturn early."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.253", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.203", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.168", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.134", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.81", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.22", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.12", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.3.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:32.795Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43047", "state": "PUBLISHED", "dateUpdated": "2026-10-19T19:06:11.151Z", "dateReserved": "2026-05-01T14:12:55.979Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-01T14:15:42.562Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/hid/hid-multitouch.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "516da3f25cfe18643835af1cf09b0e9ffc36c383", "status": "affected", "version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "versionType": "git"}, {"lessThan": "a61163daf8a90b4a7ef154d5fc9c525f665734e3", "status": "affected", "version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "versionType": "git"}, {"lessThan": "74c6015375d8b9bc1b1eb79f20636c8e894bcad7", "status": "affected", "version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "versionType": "git"}, {"lessThan": "c7a27bb4d0f6573ca0f9c7ef0b63291486239190", "status": "affected", "version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "versionType": "git"}, {"lessThan": "6a4acd3e86fe5584050c213d95147eba33856033", "status": "affected", "version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "versionType": "git"}, {"lessThan": "7f66fdbc077faed3b52519228d21d81979e92249", "status": "affected", "version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "versionType": "git"}, {"lessThan": "2edc92f89eee328b5be5706b5d431bf90669e9c0", "status": "affected", "version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "versionType": "git"}, {"lessThan": "e716edafedad4952fe3a4a273d2e039a84e8681a", "status": "affected", "version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095", "versionType": "git"}, {"status": "affected", "version": "fee906f035f0bd18ff12d84d58766c44a2ab0918", "versionType": "git"}, {"lessThan": "4.4", "status": "affected", "version": "4.3.6", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/hid/hid-multitouch.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.4"}, {"lessThan": "4.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.168", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.134", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.81", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.22", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "15075416-60DB-47BE-9105-E0E2EC70553F", "versionEndExcluding": "5.10.253", "versionStartIncluding": "4.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B", "versionEndExcluding": "6.1.168", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F56F925B-BAF8-4F4B-B62F-1496AF19A307", "versionEndExcluding": "6.6.134", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC", "versionEndExcluding": "6.12.81", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.3.6:*:*:*:*:*:*:*", "matchCriteriaId": "0F81F522-54E6-4EBA-B6C1-EB0E5DAA28A2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: Check to ensure report responses match the request\n\nIt is possible for a malicious (or clumsy) device to respond to a\nspecific report's feature request using a completely different report\nID. This can cause confusion in the HID core resulting in nasty\nside-effects such as OOB writes.\n\nAdd a check to ensure that the report ID in the response, matches the\none that was requested. If it doesn't, omit reporting the raw event and\nreturn early."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nHID: multitouch: Verificar que las respuestas del informe coincidan con la solicitud\n\nEs posible que un dispositivo malicioso (o torpe) responda a la solicitud de caracter\u00edstica de un informe espec\u00edfico utilizando un ID de informe completamente diferente. Esto puede causar confusi\u00f3n en el n\u00facleo HID, lo que resulta en efectos secundarios desagradables como escrituras fuera de l\u00edmites.\n\nA\u00f1adir una comprobaci\u00f3n para asegurar que el ID del informe en la respuesta coincida con el que fue solicitado. Si no coincide, omitir informar el evento en bruto y retornar anticipadamente."}], "id": "CVE-2026-43047", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43047", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:13:55.670356Z", "version": "2.0.3"}}]}, "published": "2026-05-01T15:16:51.073", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2edc92f89eee328b5be5706b5d431bf90669e9c0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/516da3f25cfe18643835af1cf09b0e9ffc36c383"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6a4acd3e86fe5584050c213d95147eba33856033"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/74c6015375d8b9bc1b1eb79f20636c8e894bcad7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7f66fdbc077faed3b52519228d21d81979e92249"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a61163daf8a90b4a7ef154d5fc9c525f665734e3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c7a27bb4d0f6573ca0f9c7ef0b63291486239190"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e716edafedad4952fe3a4a273d2e039a84e8681a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: HID: multitouch: Check to ensure report responses match the request", "id": "2464446", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464446"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-1287", "details": ["A flaw was found in the Linux kernel's Human Interface Device (HID) multitouch subsystem. A malicious or improperly configured HID device can respond to a feature request with an incorrect report ID. This confusion in the HID core can lead to out-of-bounds writes, potentially allowing a local attacker to achieve arbitrary code execution or cause a denial of service."], "name": "CVE-2026-43047", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43047\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43047\nhttps://lore.kernel.org/linux-cve-announce/2026050105-CVE-2026-43047-13ab@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,516da3f25cfe18643835af1cf09b0e9ffc36c383)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a61163daf8a90b4a7ef154d5fc9c525f665734e3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,74c6015375d8b9bc1b1eb79f20636c8e894bcad7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c7a27bb4d0f6573ca0f9c7ef0b63291486239190)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6a4acd3e86fe5584050c213d95147eba33856033)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7f66fdbc077faed3b52519228d21d81979e92249)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2edc92f89eee328b5be5706b5d431bf90669e9c0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e716edafedad4952fe3a4a273d2e039a84e8681a)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.253,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.203,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.168,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.134,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.81,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.22,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.12,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-01T19:15:23.983186+00:00", "updated": "2026-10-23T08:30:09.479259+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}