What’s Vulnerable › Vulnerabilities

CVE-2026-43047: HID: multitouch: Check to ensure report responses match the request

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-01 · updated 2026-10-19
• Weakness: CWE-787

Description

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Check to ensure report responses match the request It is possible for a malicious (or clumsy) device to respond to a specific report's feature request using a completely different report ID. This can cause confusion in the HID core resulting in nasty side-effects such as OOB writes. Add a check to ensure that the report ID in the response, matches the one that was requested. If it doesn't, omit reporting the raw event and return early.

Affected products

• Linux kernel: from 4.4 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.168; from 6.2 before 6.6.134; from 6.7 before 6.12.81; from 6.13 before 6.18.22 — fixed in 5.10.253, 5.15.203, 6.1.168, 6.12.81, 6.18.22, 6.19.12

How to fix

Upgrade to a fixed version: Linux kernel 5.10.253, 5.15.203, 6.1.168, 6.12.81. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/2edc92f89eee328b5be5706b5d431bf90669e9c0
• https://git.kernel.org/stable/c/516da3f25cfe18643835af1cf09b0e9ffc36c383
• https://git.kernel.org/stable/c/6a4acd3e86fe5584050c213d95147eba33856033
• https://git.kernel.org/stable/c/74c6015375d8b9bc1b1eb79f20636c8e894bcad7
• https://git.kernel.org/stable/c/7f66fdbc077faed3b52519228d21d81979e92249
• https://git.kernel.org/stable/c/a61163daf8a90b4a7ef154d5fc9c525f665734e3
• https://git.kernel.org/stable/c/c7a27bb4d0f6573ca0f9c7ef0b63291486239190
• https://git.kernel.org/stable/c/e716edafedad4952fe3a4a273d2e039a84e8681a

Get alerted when CVE-2026-43047 or the next vulnerability affects your stack