Loading story…
Multiple Linux kernel HID and force-feedback drivers contained out-of-bounds write vulnerabilities tracked as CVE-2019-19532. A malicious USB HID device could trigger the flaws on kernels earlier than 5.3.9, affecting drivers for force-feedback hardware from vendors including Logitech, Microsoft, Sony, and Holtek.
The upstream fix in commit d9d4b1e46d95 validates that a HID device has input entries before drivers access the first hid_input structure. Drivers now log “no inputs found” and return -ENODEV for malformed devices, preventing invalid list access that could cause kernel crashes or denial of service. Organizations using affected Linux kernels should deploy kernel 5.3.9 or applicable vendor security updates from Ubuntu, Debian, or openSUSE.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE-2019-19532 record was updated by MITRE, its CNA.
CVE-2019-19532 was published for multiple out-of-bounds write vulnerabilities in Linux kernel HID drivers affecting versions before 5.3.9. A malicious USB device can trigger the flaws; the issue is also identified as CID-d9d4b1e46d95.
Ubuntu issued USN-4226-1, Debian issued DLA 2068-1 and DLA 2114-1, and openSUSE issued openSUSE-SU-2020:0336 for Linux security updates related to the HID-driver vulnerability.
A Linux kernel change added empty-list checks to multiple HID force-feedback driver initialization routines, causing them to log an error and return -ENODEV when a device has no registered input entries. The change prevents invalid HID input-list dereferences that could crash the kernel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcegit.kernel.org
Open sourcepatchwork.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat remediated **CVE-2023-1073**, a moderate-severity Linux kernel flaw in the Human Interface Device (HID) subsystem. A locally authenticated, low-privilege attacker with physical access could attach a crafted USB HID device whose descriptor creates an empty report list, causing `hid_validate_values()` to invoke `list_entry()` on an invalid entry. The resulting type confusion can produce an out-of-bounds write and memory corruption, potentially causing a system crash or local privilege escalation; Red Hat assigned CVSS 6.6. The underlying HID report-list issues were reported in `hid_validate_values()` and `bigben_probe()`, and upstream patches added checks requiring non-empty lists before the entries are used. The fix landed upstream in Linux 6.1.9 and was distributed through Fedora stable updates. Red Hat released corrected kernel packages for RHEL 8 and 9, relevant RHEL 8 Extended Update Support streams, kernel-rt packages, and Red Hat Virtualization 4 on RHEL 8; the RHEL 8.8 EUS kernel update `4.18.0-477.43.1.el8_8` includes the remediation. Administrators should apply the applicable kernel update and reboot systems to activate it; RHEL 6 is not affected and RHEL 7 is outside support scope.
Aug 26, 2026
Ubuntu released kernel and Hardware Enablement (HWE) updates for Ubuntu 18.04 LTS, including Azure kernel packages, to remediate **CVE-2019-19524** and numerous other kernel vulnerabilities. CVE-2019-19524 affects the force-feedback memless input driver in `drivers/input/ff-memless.c` before Linux kernel 5.3.12; a malicious USB device could trigger a use-after-free condition, potentially causing denial of service or code execution. The upstream fix, commit `fa3a5a1880c91bb92594ad42dfe9eedad7996b86`, synchronously deletes the driver's `ml->timer` during device destruction so it cannot remain active after the input device is removed. Ubuntu's related advisories also address flaws in SMB/CIFS, wireless, USB, network, Binder IPC, tracing, and other drivers, with impacts including kernel-memory disclosure, crashes, arbitrary-file overwrite, and potential arbitrary code execution; affected systems should install the applicable standard, HWE, or Azure kernel updates.
Aug 28, 2026
A **moderate-severity** Linux kernel vulnerability, tracked as `CVE-2026-43051`, was fixed in the Wacom HID driver after maintainers found that malformed Bluetooth HID reports could trigger an out-of-bounds read in `wacom_intuos_bt_irq()`. The bug affected handling of report IDs `0x03` and `0x04`, where insufficient bounds checking allowed a malicious or compromised nearby Bluetooth device to send short reports that caused the kernel to read past the received buffer while copying data into the Wacom structure. The issue could lead to sensitive memory disclosure and system crashes. The fix adds explicit length validation for the affected report types and warning logs when undersized reports are received, with upstream patches released across multiple stable kernel branches from **5.10.253 through 7.0**. Red Hat said updates were issued for affected kernel packages in **RHEL 8, 9, and 10**, while some **RHEL 7** and **RHEL 9 `kernel-rt`** variants remained affected at publication; **RHEL 6** was not impacted because the vulnerable code was not present. Red Hat scored the flaw **CVSS 7.1**, while `cve.org` listed **8.1**.
Aug 25, 2026