CVE-2026-43047HID: multitouch: Check to ensure report responses match the request
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Check to ensure report responses match the request It is possible for a malicious (or clumsy) device to respond to a specific report's feature request using a completely different report ID. This can cause confusion in the HID core resulting in nasty side-effects such as OOB writes. Add a check to ensure that the report ID in the response, matches the one that was requested. If it doesn't, omit reporting the raw event and return early.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095 before 516da3f25cfe18643835af1cf09b0e9ffc36c383; from 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095 before a61163daf8a90b4a7ef154d5fc9c525f665734e3; from 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095 before 74c6015375d8b9bc1b1eb79f20636c8e894bcad7; from 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095 before c7a27bb4d0f6573ca0f9c7ef0b63291486239190; 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095 builds before 6a4acd3e86fe5584050c213d95147eba33856033; from 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095 before 7f66fdbc077faed3b52519228d21d81979e92249; 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095 builds before 2edc92f89eee328b5be5706b5d431bf90669e9c0; from 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095 before e716edafedad4952fe3a4a273d2e039a84e8681a; and 2 more ranges | CNA record |
linux linux_kernel linux:linux_kernel | from 4.4 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.168; from 6.2 before 6.6.134; from 6.7 before 6.12.81; from 6.13 before 6.18.22; from 6.19 before 6.19.12; 4.3.6; and 4 more ranges | NVD |
References
- https://git.kernel.org/stable/c/516da3f25cfe18643835af1cf09b0e9ffc36c383patch
- https://git.kernel.org/stable/c/a61163daf8a90b4a7ef154d5fc9c525f665734e3patch
- https://git.kernel.org/stable/c/74c6015375d8b9bc1b1eb79f20636c8e894bcad7patch
- https://git.kernel.org/stable/c/c7a27bb4d0f6573ca0f9c7ef0b63291486239190patch
- https://git.kernel.org/stable/c/6a4acd3e86fe5584050c213d95147eba33856033patch
- https://git.kernel.org/stable/c/7f66fdbc077faed3b52519228d21d81979e92249patch
- https://git.kernel.org/stable/c/2edc92f89eee328b5be5706b5d431bf90669e9c0patch
- https://git.kernel.org/stable/c/e716edafedad4952fe3a4a273d2e039a84e8681apatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.