The Linux kernel’s HID multitouch driver does not verify that the report ID in a device’s response matches the ID requested. When a device returns a different report ID, the kernel may incorrectly process the event, potentially leading to out‑of‑bounds writes and kernel memory corruption. This flaw is an example of insufficient input validation that can compromise system integrity.

Kernel versions 4.3.6 and the 7.0 release candidates rc1 through rc4 are explicitly listed as affected. The vulnerability resides in the generic Linux:HID multitouch driver and therefore also impacts any other kernel that lacks the patch. All Linux installations running these kernel versions—or any other unpatched kernels—are potentially vulnerable; administrators should verify their kernel release and apply the update as soon as possible.

The CVSS score of 7.8 indicates a high impact severity. The EPSS score of < 1% denotes a low empirically observed exploitation probability, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker could send a mismatched report ID over a USB or Bluetooth HID interface to trigger the vulnerability. The likely attack vector is through physical or remote device pairing, as inferred from the mention of HID interfaces. An attacker could cause out‑of‑bounds writes that may destabilize the system. Thus, while the exploitation likelihood remains low, the potential damage is high due to possible kernel memory corruption.