CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a maliciou...

Security readout for executives and security teams

This is a Linux kernel flaw where a malicious USB HID device could trigger memory corruption in a tablet input driver while debug messages are being generated. The main business concern is systems that accept untrusted USB devices or USB passthrough. Public sources do not show CISA KEV listing or confirmed active exploitation. Likely exposure is Linux systems with affected kernels where GTCO tablet/HID handling is present and untrusted USB devices can be attached or passed through. End-user workstations, kiosks, labs, and virtualized environments with USB passthrough are more relevant than locked-down servers without physical USB access. Treat as a focused kernel hygiene issue, not an internet-scale emergency. Prioritize exposed endpoints and environments where users, visitors, or tenants can introduce USB devices. Patch during normal high-priority kernel maintenance unless local USB threat risk is elevated. Mitigation focus: Apply kernel updates from the relevant Linux distribution advisory.; Restrict untrusted USB device attachment on affected systems.; Disable USB passthrough into sensitive virtual machines unless required..

Prepared

Jun 6, 2026, 20:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.