In the Linux kernel’s HID multitouch subsystem, data received from a device is not validated against the original request; the report ID in the response is not checked. When a mismatched report ID is returned, the kernel may process a wrong report, leading to out‑of‑bounds writes. This lack of validation can cause kernel memory corruption and instability, originating from insufficient input validation within the driver code.

Kernel versions 4.3.6 and the 7.0 release candidates rc1–rc4 are explicitly listed as affected by the CVE. The vulnerability resides in the generic Linux:HID multitouch device driver and therefore also impacts any other kernel that lacks the patch. Thus, all Linux installations running these kernel versions—or any other unpatched kernels—are potentially vulnerable; administrators should verify their kernel release and apply the update as soon as possible.

The CVSS score of 7.8 indicates a high impact severity. The EPSS score of < 1% denotes a low empirically observed exploitation probability, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker could send a mismatched report ID over a USB or Bluetooth HID interface to trigger the vulnerability. The likely attack vector is through physical or remote device pairing, as inferred from the mention of HID interfaces. An attacker could cause out‑of‑bounds writes that may destabilize the system. Thus, while the exploitation likelihood remains low, the potential damage is high due to possible kernel memory corruption.