Loading story…
Red Hat remediated CVE-2023-1073, a moderate-severity Linux kernel flaw in the Human Interface Device (HID) subsystem. A locally authenticated, low-privilege attacker with physical access could attach a crafted USB HID device whose descriptor creates an empty report list, causing hid_validate_values() to invoke list_entry() on an invalid entry. The resulting type confusion can produce an out-of-bounds write and memory corruption, potentially causing a system crash or local privilege escalation; Red Hat assigned CVSS 6.6.
The underlying HID report-list issues were reported in hid_validate_values() and bigben_probe(), and upstream patches added checks requiring non-empty lists before the entries are used. The fix landed upstream in Linux 6.1.9 and was distributed through Fedora stable updates. Red Hat released corrected kernel packages for RHEL 8 and 9, relevant RHEL 8 Extended Update Support streams, kernel-rt packages, and Red Hat Virtualization 4 on RHEL 8; the RHEL 8.8 EUS kernel update 4.18.0-477.43.1.el8_8 includes the remediation. Administrators should apply the applicable kernel update and reboot systems to activate it; RHEL 6 is not affected and RHEL 7 is outside support scope.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2024:0575, an Important RHEL 8.8 Extended Update Support kernel update containing the fix for CVE-2023-1073. The update provided kernel version 4.18.0-477.43.1.el8_8 and required a reboot for the fix to take effect.
Alex reported the HID hid_validate_values() empty-report-list validation issue, which Red Hat tracked as Bug 2173403 and later assigned CVE-2023-1073.
Red Hat addressed CVE-2023-1073 in RHEL 9 through RHSA-2023:6583 and in RHEL 8 through RHSA-2023:6901 and RHSA-2023:7077.
The upstream fix for CVE-2023-1073 was included in Linux kernel version 6.1.9 and subsequently delivered to Fedora through stable kernel updates.
Pietro Borrello disclosed unchecked list_entry() uses in the Linux HID driver, including hid_validate_values(), which malicious HID descriptors with empty report lists could trigger. Patches were submitted to require non-empty report lists before use.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceopenwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **moderate-severity** Linux kernel vulnerability, tracked as `CVE-2026-43051`, was fixed in the Wacom HID driver after maintainers found that malformed Bluetooth HID reports could trigger an out-of-bounds read in `wacom_intuos_bt_irq()`. The bug affected handling of report IDs `0x03` and `0x04`, where insufficient bounds checking allowed a malicious or compromised nearby Bluetooth device to send short reports that caused the kernel to read past the received buffer while copying data into the Wacom structure. The issue could lead to sensitive memory disclosure and system crashes. The fix adds explicit length validation for the affected report types and warning logs when undersized reports are received, with upstream patches released across multiple stable kernel branches from **5.10.253 through 7.0**. Red Hat said updates were issued for affected kernel packages in **RHEL 8, 9, and 10**, while some **RHEL 7** and **RHEL 9 `kernel-rt`** variants remained affected at publication; **RHEL 6** was not impacted because the vulnerable code was not present. Red Hat scored the flaw **CVSS 7.1**, while `cve.org` listed **8.1**.
Aug 25, 2026
**CVE-2022-48836** is a moderate-severity Linux kernel flaw in `usb_submit_urb()` involving improper validation of USB endpoint types, associated with the Aiptek input driver. A local, low-privileged attacker can trigger the issue without user interaction, potentially causing a denial of service through high availability impact; Red Hat rates it CVSS 3.1 **5.5**. Red Hat released fixes in the `kernel` and `kernel-rt` packages for Red Hat Enterprise Linux 8. RHEL 9 remains affected, while its `kernel-rt` package is marked will not fix; RHEL 6 and 7 are outside support and should be treated as potentially vulnerable. The flaw maps to **CWE-1287**, in which software fails to enforce that supplied input matches its expected type, underscoring the need for strict allowlist-based validation of endpoint and other typed inputs.
Aug 26, 2026
**CVE-2024-26717** is a local denial-of-service flaw in the Linux kernel's Open Firmware (OF) I2C HID driver at `drivers/hid/i2c-hid/i2c-hid-of.c`. Introduced in kernel 5.12 when I2C HID support was split into ACPI and OF implementations, the OF driver can leave a client pointer uninitialized; a failed device power-up can then trigger a NULL-pointer dereference and crash or restart the kernel. The issue is fixed in upstream kernels 5.15.149, 6.1.79, 6.6.18, 6.7.6, and 6.8 and later. Red Hat rated the flaw CVSS 4.4 (low) and released corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.4 Extended Update Support systems; its referenced advisory listed RHEL 9 `kernel-rt` as affected without a corresponding erratum. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual patch.
Aug 26, 2026