Security readout for executives and security teams
Plain-English summary
A malicious or malfunctioning multitouch HID device can return an unexpected report identifier and confuse the Linux kernel. The resulting memory corruption may cause crashes or compromise confidentiality and system integrity. Exploitation requires local access or control of a connected device, so systems exposed to untrusted peripherals deserve the fastest attention.
Executive priority
Prioritize shared, physically accessible, kiosk, and high-value Linux endpoints that accept HID devices. Treat remediation as high priority, but not an internet-wide emergency: the evidence indicates a local peripheral-dependent path and does not show active exploitation. Use normal expedited kernel patching, with tighter peripheral controls where updates cannot be applied promptly.
Technical view
The Linux HID multitouch driver did not verify that a feature-response report ID matched the requested report. A mismatched response could confuse HID core processing and produce out-of-bounds writes. The fix rejects mismatched responses, suppresses the raw event, and returns early. CVSS 3.1 is 7.8: local, low complexity, low privileges, no user interaction, with high impact.
Likely exposure
Exposure is most plausible on affected Linux systems using HID multitouch devices, particularly kiosks, shared workstations, laboratories, and endpoints permitting untrusted peripherals. The supplied version metadata identifies multiple affected release lines but contains ambiguous entries, including “0” and commit hashes. Confirm exposure against distribution-specific kernel builds and backports rather than relying only on upstream version numbers.
Exploitation context
The supplied sources do not establish active exploitation, and the record is not marked as KEV. The attack vector is local and depends on a device providing a mismatched HID report response. A defective device could also trigger the flaw accidentally. No evidence in the bundle establishes public exploit availability, observed attacks, or reliable exploitation outcomes.
Researcher notes
The security-relevant behavior is an out-of-bounds write caused by accepting a feature response for a different report ID. The patch validates response/request correspondence before raw-event processing. The supplied affected-version data is insufficient for dependable branch-boundary analysis; inspect the linked stable commits and distribution backports. No CWE was assigned in the bundle.
Mitigation direction
- Update to a distribution-supported kernel containing the applicable linked stable fix.
- Reboot affected systems and confirm the corrected kernel is active.
- Check distribution vendor guidance for backport status and precise fixed package versions.
- Until updated, restrict untrusted HID peripherals on exposed or shared systems.
Validation and detection
- Inventory active kernel versions and distribution package identifiers across Linux systems.
- Identify systems loading HID multitouch support or accepting externally controlled HID devices.
- Confirm installed kernels contain the report-ID validation fix or an equivalent vendor backport.
- After updating, verify every system booted into the corrected kernel.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43047 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/516da3f25cfe18643835af1cf09b0e9ffc36c383CVE reference, Linux
- https://git.kernel.org/stable/c/a61163daf8a90b4a7ef154d5fc9c525f665734e3CVE reference, Linux
- https://git.kernel.org/stable/c/74c6015375d8b9bc1b1eb79f20636c8e894bcad7CVE reference, Linux
- https://git.kernel.org/stable/c/c7a27bb4d0f6573ca0f9c7ef0b63291486239190CVE reference, Linux
- https://git.kernel.org/stable/c/6a4acd3e86fe5584050c213d95147eba33856033CVE reference, Linux
- https://git.kernel.org/stable/c/7f66fdbc077faed3b52519228d21d81979e92249CVE reference, Linux
- https://git.kernel.org/stable/c/2edc92f89eee328b5be5706b5d431bf90669e9c0CVE reference, Linux
- https://git.kernel.org/stable/c/e716edafedad4952fe3a4a273d2e039a84e8681aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.