Look up another CVE · open CVE-2026-43048 in the interactive tracker
CVE-2026-43048
HID: core: Mitigate potential OOB by removing bogus memset()
Published 2026-05-01 (6 months ago) by the Linux kernel CNA. Subsystem drivers/hid. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-43048 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | vulnerable | 6.12.113-1 | No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication. |
| Debian 14forky | fixed | 6.19.12-1 | Update the kernel and reboot. Fixed in 6.19.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.19.12-1 | Update the kernel and reboot. Fixed in 6.19.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The memset() in hid_report_raw_event() has the good intention of clearing out bogus data by zeroing the area from the end of the incoming data string to the assumed end of the buffer. However, as we have previously seen, doing so can easily result in OOB reads and writes in the subsequent thread of execution. The current suggestion from one of the HID maintainers is to remove the memset() and simply return if the incoming event buffer size is not large enough to fill the associated report. Suggested-by Benjamin Tissoires <bentiss@kernel.org> [bentiss: changed the return value]
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/hid/hid-core.c
- What this is
- HID CORE LAYERMAINTAINERS section matched on drivers/hid/ · linux-input@vger.kernel.org · Maintained
- Kernel module
- hid
Check it on the machine
grep -wE 'CONFIG_HID|CONFIG_HID_SUPPORT' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w hidPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on arm64/cloud-arm64
- trixieBnot built on arm64/cloud-arm64
- forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- B
- built in on some, a module on others, absent on the rest
- Build switches
- CONFIG_HID, CONFIG_HID_SUPPORT
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-05-01 (6 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.40%, higher than 32.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/hid
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.15 | 6.18.22 | 8f7103464973 |
| 2.6.15 | 6.19.12 | bd6e1d0230cc |
| 2.6.15 | 7.0 | 0a3fe972a7cb |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- The vulnerable HID report parsing can be reached by attacker-controlled Bluetooth HID devices sending crafted short input reports over an established HIDP interrupt/control channel. This is adjacent-network reachability rather than physical-only because Bluetooth HID is a supported HID transport.
- AC:LAttack complexity, low
- The attacker controls the HID report descriptor/report IDs and the short report contents, and no race or condition outside the attacker's control is required. A malformed report can be sent repeatedly once the HID device is connected.
- PR:NPrivileges required, none
- The adjacent HID peer does not need privileges on the target system to send the report data processed by the kernel. Local HIDP setup is performed by the host Bluetooth stack, but the attacker-controlled peer supplies the malicious descriptor and events.
- UI:NUser interaction, none
- After the malicious or compromised HID device is connected, exploitation is triggered by device-sent reports without any further victim action. Under the required higher-severity rule, pairing/connection uncertainty is not treated as required interaction.
- S:UScope, unchanged
- The corruption occurs in the Linux kernel HID processing context and impacts the same kernel security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.
- C:HConfidentiality impact, high
- The bug is an out-of-bounds memory access in kernel report handling, and descriptor-controlled parsing can drive reads beyond the supplied report object. Kernel memory corruption is plausibly usable to obtain sensitive kernel memory disclosure.
- I:HIntegrity impact, high
- The removed memset performed an out-of-bounds zero write past short report buffers for some call paths, including small stack/static translated reports. Kernel OOB writes are memory corruption and are defensibly scored as high integrity impact.
- A:HAvailability impact, high
- The OOB write/read can corrupt kernel memory or fault during HID event processing, leading to an oops or system crash. The triggering report can be resent by the attacker-controlled HID peer.