Input Validation Flaw in Linux Kernel's HID Features

CVE-2026-43047

What is CVE-2026-43047?

The Linux kernel has been identified with a vulnerability in the Human Interface Device (HID) subsystem where a malicious or improperly functioning device can respond to a feature request with an erroneous report ID. This mismatch between the requested and returned report IDs can confuse the HID core leading to potential out-of-bounds (OOB) write operations, causing unpredictable side effects. This vulnerability has been addressed by implementing checks to ensure that the response report ID corresponds correctly with the initial request, enhancing the overall security and stability of device interactions.

References