CVE-2026-43048

A flaw was found in the Linux kernel's Human Interface Device (HID) core. An incorrect memset() operation within the hid_report_raw_event() function can lead to out-of-bounds (OOB) reads and writes. This vulnerability occurs when the incoming event buffer size is insufficient to fill the associated report, potentially allowing an attacker to cause information disclosure or other memory corruption issues.

Removing an incorrect memset in HID core avoids writing past tiny report allocation edges flagged by KASAN. Red Hat recommends patched kernels for USB HID stacks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.