An out-of-bounds write vulnerability in the Linux kernel HID multitouch driver affects multiple stable branches and can lead to local system compromise.

This is an improper input validation flaw in the HID multitouch subsystem where report responses are not adequately checked against original requests, requiring local access with low privileges.

A successful exploit of this flaw can allow a malicious or compromised peripheral device to trigger out-of-bounds memory writes, potentially leading to arbitrary code execution, privilege escalation, or kernel panic. This results in severe integrity and availability risks for affected hosts. Given the CVSS score of 7.8, the severity is high, reflecting significant potential impact despite requiring local vector access.

Immediate Action: Update the Linux kernel to version 5.10.253, 5.15.203, 6.1.168, 6.6.134, or later depending on the active release branch.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, and unexpected driver behavior or crashes associated with human interface devices.

Compensating Controls: Restrict physical access to server hardware and enforce strict user privilege boundaries to prevent unauthorized local accounts from connecting untrusted USB devices.

Public Exploit Available: No (false / unknown)

Administrators managing systems with physical hardware interaction or untrusted USB peripherals should prioritize patching against CVE-2026-43047. Applying the latest stable kernel updates eliminates the missing report ID validation check and secures the multitouch driver against malformed hardware responses.