CyberSecBulletin
CVE-2026-43051NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-43051 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada, 5b5b9730111808410e404ceac2fabd32eef92fbd, fa8901cb1f0b2113a342db93bd5684b59fe99dcf as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.26% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada or 5b5b9730111808410e404ceac2fabd32eef92fbd or fa8901cb1f0b2113a342db93bd5684b59fe99dcf or 8bd690ac1242332c73cba10dacdad6c6642bbb94, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.253 or 5.15.203 or 6.1.168 or 6.6.134, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a up to, but not including, d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada; 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a up to, but not including, 5b5b9730111808410e404ceac2fabd32eef92fbd; 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a up to, but not including, fa8901cb1f0b2113a342db93bd5684b59fe99dcf; 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a up to, but not including, 8bd690ac1242332c73cba10dacdad6c6642bbb94; 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a up to, but not including, 41026bcc0fdf82605205c27935ef719cbc07193b; 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a up to, but not including, c8dc23c97680eebefde06da5858aaef1b37cf75d; 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a up to, but not including, 3d78386b144453c47e81bf62dc3601b757f02d99; 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a up to, but not including, 2f1763f62909ccb6386ac50350fa0abbf5bb16a9; and 1 more rangesd0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada, 5b5b9730111808410e404ceac2fabd32eef92fbd, fa8901cb1f0b2113a342db93bd5684b59fe99dcf, 8bd690ac1242332c73cba10dacdad6c6642bbb94, 41026bcc0fdf82605205c27935ef719cbc07193b, c8dc23c97680eebefde06da5858aaef1b37cf75d
LinuxLinux Kernel3.3 up to, but not including, 5.10.253; 5.11 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.168; 6.2 up to, but not including, 6.6.134; 6.7 up to, but not including, 6.12.81; 6.13 up to, but not including, 6.18.22; 6.19 up to, but not including, 6.19.12; 7.05.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short report can trigger an out-of-bounds read when copying data into the wacom structure. Specifically, report 0x03 requires at least 22 bytes to safely read the processed data and battery status, while report 0x04 (which falls through to 0x03) requires 32 bytes. Add explicit length checks for these report IDs and log a warning if a short report is received.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.