CVE-2026-43051 - Vulnerability Details

- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq

The wacom_intuos_bt_irq() function processes Bluetooth HID reports
without sufficient bounds checking. A maliciously crafted short report
can trigger an out-of-bounds read when copying data into the wacom
structure.

Specifically, report 0x03 requires at least 22 bytes to safely read
the processed data and battery status, while report 0x04 (which
falls through to 0x03) requires 32 bytes.

Add explicit length checks for these report IDs and log a warning if
a short report is received.

Published: 2026-05-01

Score: 8.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel driver for Wacom tablets contains an out‑of‑bounds read in the wacom_intuos_bt_irq() routine. The routine copies Bluetooth HID reports into an internal structure without checking that the report is large enough. An attacker who can send a maliciously short report (identifiers 0x03 or 0x04) can trigger this over‑read, exposing the kernel to data leakage or crashes. This weakness is best classified as an out‑of‑bounds read (CWE‑125, CWE‑788).

Affected Systems

Affected systems include any Linux kernel that includes the default Wacom HID driver without the bounds‑check fix. The CVE does not list specific kernel versions, but the fix appears in commits referenced in the CVE references; distributions shipping kernels prior to those commits are potentially vulnerable.

Risk and Exploitability

The CVSS score is 8.1 and the EPSS score is < 1%, indicating a very low but non-zero exploitation probability. The bug requires an attacker to send crafted Bluetooth HID reports to the tablet, which may be feasible for anyone who can pair with or control the device. While the vulnerability does not provide a reliable privilege escalation path, it can cause denial of service or information disclosure. The issue is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a`	affected	< d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada
`78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a`	affected	< 5b5b9730111808410e404ceac2fabd32eef92fbd
`78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a`	affected	< fa8901cb1f0b2113a342db93bd5684b59fe99dcf
`78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a`	affected	< 8bd690ac1242332c73cba10dacdad6c6642bbb94
`78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a`	affected	< 41026bcc0fdf82605205c27935ef719cbc07193b
`78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a`	affected	< c8dc23c97680eebefde06da5858aaef1b37cf75d
`78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a`	affected	< 3d78386b144453c47e81bf62dc3601b757f02d99
`78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a`	affected	< 2f1763f62909ccb6386ac50350fa0abbf5bb16a9

Linux

affected

Version	Status	Constraints
`3.3`	affected	—
`0`	unaffected	< 3.3
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.168`	unaffected	≤ 6.1.*
`6.6.134`	unaffected	≤ 6.6.*
`6.12.81`	unaffected	≤ 6.12.*
`6.18.22`	unaffected	≤ 6.18.*
`6.19.12`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5b5b9730111808410e404ceac2fabd32eef92fbd)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fa8901cb1f0b2113a342db93bd5684b59fe99dcf)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8bd690ac1242332c73cba10dacdad6c6642bbb94)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,41026bcc0fdf82605205c27935ef719cbc07193b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c8dc23c97680eebefde06da5858aaef1b37cf75d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3d78386b144453c47e81bf62dc3601b757f02d99)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2f1763f62909ccb6386ac50350fa0abbf5bb16a9)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.10.253,5.11.0)`	unaffected	semver	—
`[5.15.203,5.16.0)`	unaffected	semver	—
`[6.1.168,6.2.0)`	unaffected	semver	—
`[6.6.134,6.7.0)`	unaffected	semver	—
`[6.12.81,6.13.0)`	unaffected	semver	—
`[6.18.22,6.19.0)`	unaffected	semver	—
`[6.19.12,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to the latest version that incorporates the wacom_intuos_bt_irq() bounds‑check fix.
If a kernel update cannot be applied immediately, disable or remove the Bluetooth HID functionality for the Wacom tablet (e.g., unplug the device or block the corresponding kernel module).
Ensure that only trusted devices can pair with the tablet by enforcing strict Bluetooth pairing policies when the device remains connected.

Generated by OpenCVE AI on May 3, 2026 at 07:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DLA	DLA-4606-1	linux security update
Debian DSA	DSA-6243-1	linux security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0003.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2f1763f62909ccb6386ac50350fa0abbf5bb16a9
https://git.kernel.org/stable/c/3d78386b144453c47e81bf62dc3601b757f02d99
https://git.kernel.org/stable/c/41026bcc0fdf82605205c27935ef719cbc07193b
https://git.kernel.org/stable/c/5b5b9730111808410e404ceac2fabd32eef92fbd
https://git.kernel.org/stable/c/8bd690ac1242332c73cba10dacdad6c6642bbb94
https://git.kernel.org/stable/c/c8dc23c97680eebefde06da5858aaef1b37cf75d
https://git.kernel.org/stable/c/d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada
https://git.kernel.org/stable/c/fa8901cb1f0b2113a342db93bd5684b59fe99dcf
https://lore.kernel.org/linux-cve-announce/2026050107-CVE-2026-43051-0d15@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43051
https://www.cve.org/CVERecord?id=CVE-2026-43051

History

Thu, 07 May 2026 18:00:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::

Sun, 03 May 2026 06:30:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}`

Sat, 02 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026050107-CVE-2026-43051-0d15@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43051 https://www.cve.org/CVERecord?id=CVE-2026-43051
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Fri, 01 May 2026 23:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-788

Fri, 01 May 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short report can trigger an out-of-bounds read when copying data into the wacom structure. Specifically, report 0x03 requires at least 22 bytes to safely read the processed data and battery status, while report 0x04 (which falls through to 0x03) requires 32 bytes. Add explicit length checks for these report IDs and log a warning if a short report is received.
Title		HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2f1763f62909ccb6386ac50350fa0abbf5bb16a9 https://git.kernel.org/stable/c/3d78386b144453c47e81bf62dc3601b757f02d99 https://git.kernel.org/stable/c/41026bcc0fdf82605205c27935ef719cbc07193b https://git.kernel.org/stable/c/5b5b9730111808410e404ceac2fabd32eef92fbd https://git.kernel.org/stable/c/8bd690ac1242332c73cba10dacdad6c6642bbb94 https://git.kernel.org/stable/c/c8dc23c97680eebefde06da5858aaef1b37cf75d https://git.kernel.org/stable/c/d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada https://git.kernel.org/stable/c/fa8901cb1f0b2113a342db93bd5684b59fe99dcf

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-01T14:15:45.314Z

Updated: 2026-05-11T22:16:45.927Z

Reserved: 2026-05-01T14:12:55.980Z

Link: CVE-2026-43051

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-01T15:16:51.543

Modified: 2026-05-07T18:00:03.043

Link: CVE-2026-43051

Redhat

Severity : Important

Publid Date: 2026-05-01T00:00:00Z

Links: CVE-2026-43051 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-03T07:45:16Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object