Out-of-Bounds Vulnerability in Linux Kernel Affecting HID Core Functionality

CVE-2026-43048

What is CVE-2026-43048?

A newly identified vulnerability in the Linux kernel impacts the HID core functionality due to improper handling of data buffers. Specifically, the memset() function in hid_report_raw_event() was intended to zero out invalid data but instead introduces risks of out-of-bounds reads and writes. The recommended fix involves removing this memset() operation and implementing a check to ensure the incoming event buffer size is adequate. This change aims to enhance the security posture of the affected systems by preventing unintended memory access in subsequent execution threads.

References