CVE-2026-43047

A flaw was found in the Linux kernel's Human Interface Device (HID) multitouch subsystem. A malicious or improperly configured HID device can respond to a feature request with an incorrect report ID. This confusion in the HID core can lead to out-of-bounds writes, potentially allowing a local attacker to achieve arbitrary code execution or cause a denial of service.

HID multitouch class must verify report responses match outstanding requests to avoid confusing device state machines. Red Hat advises kernel updates; HID core is not unloadable in practice.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.