Out-of-Bounds Read Vulnerability in Wacom Devices from Linux Kernel

CVE-2026-43051

What is CVE-2026-43051?

A vulnerability has been identified in the Linux kernel where the wacom_intuos_bt_irq() function processes Bluetooth HID reports without adequate bounds checking. This flaw allows a maliciously constructed short report to cause an out-of-bounds read when data is copied into the Wacom structure. Specifically, report 0x03 requires a minimum of 22 bytes for safe processing, while report 0x04, which defaults to 0x03, demands 32 bytes. The issue has been addressed by introducing explicit length checks for these report IDs, ensuring that warnings are logged if a short report is encountered.

References