CVE-2026-43047: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-43047 is a vulnerability in the Linux kernel's HID multitouch driver that allows a malicious or malfunctioning USB/HID device to trigger out-of-bounds (OOB) memory writes by responding to a feature report request with a mismatched report ID. It was published on May 1, 2026, and affects multiple Linux kernel versions across several stable branches. Affected versions include kernels from 4.4 through 5.10.252, 5.11 through 5.15.202, 5.16 through 6.1.167, 6.2 through 6.6.133, 6.7 through 6.12.80, 6.13 through 6.18.21, and 6.19 through 6.19.11. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat).

The root cause is improper validation of specified input type (CWE-1287) in the HID multitouch driver, leading to an out-of-bounds write (CWE-787). When the kernel issues a feature report request to a HID device, it does not verify that the report ID in the device's response matches the requested report ID. A malicious or malfunctioning device can respond with a completely different report ID, causing the HID core to process data in an unexpected context and potentially write beyond the bounds of an allocated buffer. The fix adds an explicit check comparing the response report ID to the requested one, returning early without processing the raw event if they do not match (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can result in out-of-bounds kernel memory writes, which may lead to arbitrary code execution in kernel context, privilege escalation, or a kernel crash (denial of service). The vulnerability affects the confidentiality, integrity, and availability of the system at a high level. Because exploitation occurs in kernel space, a successful attack could grant an attacker full control over the affected system (GitHub Advisory, Red Hat).

Exploitation requires local access and low privileges — specifically, the ability to connect a malicious HID device to the target system (physical or via USB passthrough in virtualized environments). There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, indicating a low probability of exploitation in the near term (GitHub Advisory, Feedly).

Patches have been released for the following Linux kernel stable versions: 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0. Administrators should update to one of these patched versions as the primary remediation. As a workaround where patching is not immediately possible, restrict physical access to USB ports to prevent connection of untrusted HID devices, or disable HID multitouch kernel module support if not required (modprobe -r hid-multitouch). Amazon Linux 2 and Amazon Linux 2023 users can refer to their respective ALAS advisories for distribution-specific updates (GitHub Advisory, Amazon Linux 2 ALAS, Amazon Linux 2023 ALAS).

Red Hat has acknowledged the vulnerability and assigned it a Medium severity rating, tracking it via Bugzilla. The vulnerability received standard coverage from automated CVE tracking services and security news aggregators shortly after disclosure, with no notable researcher commentary or significant community debate identified (Red Hat, Red Hat Bugzilla).