Loading story…
A moderate-severity Linux kernel vulnerability, tracked as CVE-2026-43051, was fixed in the Wacom HID driver after maintainers found that malformed Bluetooth HID reports could trigger an out-of-bounds read in wacom_intuos_bt_irq(). The bug affected handling of report IDs 0x03 and 0x04, where insufficient bounds checking allowed a malicious or compromised nearby Bluetooth device to send short reports that caused the kernel to read past the received buffer while copying data into the Wacom structure. The issue could lead to sensitive memory disclosure and system crashes.
The fix adds explicit length validation for the affected report types and warning logs when undersized reports are received, with upstream patches released across multiple stable kernel branches from 5.10.253 through 7.0. Red Hat said updates were issued for affected kernel packages in RHEL 8, 9, and 10, while some RHEL 7 and RHEL 9 kernel-rt variants remained affected at publication; RHEL 6 was not impacted because the vulnerable code was not present. Red Hat scored the flaw CVSS 7.1, while cve.org listed 8.1.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat released a fix for CVE-2026-43051 in the Red Hat Enterprise Linux 8 kernel-rt package via advisory RHSA-2026:21745.
Red Hat released a fix for CVE-2026-43051 in the Red Hat Enterprise Linux 8 kernel via advisory RHSA-2026:21706.
Red Hat released a fix for CVE-2026-43051 in the Red Hat Enterprise Linux 10 kernel via advisory RHSA-2026:21557.
Red Hat released a fix for CVE-2026-43051 in the Red Hat Enterprise Linux 9 kernel via advisory RHSA-2026:21556.
Red Hat published its CVE entry for CVE-2026-43051, describing a moderate-severity out-of-bounds read in the Linux kernel Wacom HID driver that can be triggered by crafted short Bluetooth reports.
Fixes for CVE-2026-43051 were released in Linux kernel versions 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0. The fix added explicit length checks for report IDs 0x03 and 0x04 and warning logs for short reports.
The Linux kernel CVE team assigned CVE-2026-43051 to an out-of-bounds read flaw in the Wacom HID driver’s wacom_intuos_bt_irq() function, caused by insufficient bounds checking on Bluetooth HID reports.
Red Hat last modified its CVE-2026-43051 entry, updating the vendor record for the Linux kernel Wacom HID vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat remediated **CVE-2023-1073**, a moderate-severity Linux kernel flaw in the Human Interface Device (HID) subsystem. A locally authenticated, low-privilege attacker with physical access could attach a crafted USB HID device whose descriptor creates an empty report list, causing `hid_validate_values()` to invoke `list_entry()` on an invalid entry. The resulting type confusion can produce an out-of-bounds write and memory corruption, potentially causing a system crash or local privilege escalation; Red Hat assigned CVSS 6.6. The underlying HID report-list issues were reported in `hid_validate_values()` and `bigben_probe()`, and upstream patches added checks requiring non-empty lists before the entries are used. The fix landed upstream in Linux 6.1.9 and was distributed through Fedora stable updates. Red Hat released corrected kernel packages for RHEL 8 and 9, relevant RHEL 8 Extended Update Support streams, kernel-rt packages, and Red Hat Virtualization 4 on RHEL 8; the RHEL 8.8 EUS kernel update `4.18.0-477.43.1.el8_8` includes the remediation. Administrators should apply the applicable kernel update and reboot systems to activate it; RHEL 6 is not affected and RHEL 7 is outside support scope.
Aug 26, 2026
A flaw in the Linux kernel's Bluetooth management (`MGMT`) component, tracked as **CVE-2026-43020**, was fixed after maintainers found that Long Term Key (`LTK`) `enc_size` values were not properly validated during load operations. An attacker with local low-privilege access could supply an `enc_size` larger than the 16-byte key buffer, allowing invalid data to be stored and later used in fixed-size stack operations when the kernel replied to LE LTK requests, creating a stack buffer overflow condition with denial-of-service and possible broader memory-corruption impact. The vulnerable code is in `net/bluetooth/mgmt.c` and has reportedly been present since Linux kernel 3.4. Upstream fixes were released across multiple stable branches, including 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0, by rejecting oversized `enc_size` values during management LTK record validation. Red Hat said fixes were issued for Red Hat Enterprise Linux 8, 9, and 10 through RHSA advisories, while RHEL 7, RHEL 7 `kernel-rt`, and RHEL 9 `kernel-rt` remained listed as affected at publication; RHEL 6 was listed as not affected because the vulnerable code is absent.
Aug 25, 2026
Red Hat disclosed **CVE-2025-39981**, a Linux kernel flaw in the Bluetooth management subsystem that can trigger a **use-after-free** or double-free condition in `mgmt_pending` handling. The bug was traced to `struct mgmt_pending` objects being freed while still in use, with a KASAN report identifying a slab use-after-free in `mgmt_add_adv_patterns_monitor_sync`. Red Hat rated the issue **Moderate** with a **CVSS v3 score of 7.3**, warning that a local attacker able to interact with the Bluetooth subsystem could cause memory corruption leading to denial of service or possible privilege escalation. The weakness maps to **`CWE-416` (Use After Free)**, a class of memory-safety bugs that can enable crashes, information disclosure, or arbitrary code execution when freed memory is later referenced. The kernel fix adds `mgmt_pending_valid` checks and removes commands from the pending list while holding `mgmt_pending_lock` to prevent TOCTOU-related misuse. Red Hat said fixes were shipped for multiple **RHEL 8, 9, and 10** kernel packages, while **RHEL 6** was not affected because the vulnerable code is absent; the company also recommended hardening or disabling Bluetooth management interfaces where they are not needed.
Aug 25, 2026