CVE-2026-43051

A flaw was found in the Linux kernel's Wacom Human Interface Device (HID) driver. This vulnerability allows a remote attacker to trigger an out-of-bounds read by sending a specially crafted, short Bluetooth HID report. This can lead to the disclosure of sensitive information from the system's memory.

A Bluetooth HID report parsing bug in the Wacom driver can cause an out of bounds read in wacom_intuos_bt_irq. Report 0x03 needs at least 22 bytes and report 0x04 needs 32 bytes because it falls through into the 0x03 handling path, but the old code processed shorter reports without validating these lengths. A malicious or compromised Bluetooth HID device can send a crafted short report and make the kernel read past the received report buffer while updating Wacom input or battery state. For the CVSS the PR:N is used in the paranoid score because the attacker only needs Bluetooth device control and does not need a local account on the victim. The issue is adjacent network reachable over Bluetooth rather than Internet reachable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.