Bug 2464494 (CVE-2026-43048)

Summary: CVE-2026-43048 kernel: HID: core: Mitigate potential OOB by removing bogus memset()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's Human Interface Device (HID) core. An incorrect `memset()` operation within the `hid_report_raw_event()` function can lead to out-of-bounds (OOB) reads and writes. This vulnerability occurs when the incoming event buffer size is insufficient to fill the associated report, potentially allowing an attacker to cause information disclosure or other memory corruption issues.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-01 15:09:55 UTC 
In the Linux kernel, the following vulnerability has been resolved:

HID: core: Mitigate potential OOB by removing bogus memset()

The memset() in hid_report_raw_event() has the good intention of
clearing out bogus data by zeroing the area from the end of the incoming
data string to the assumed end of the buffer.  However, as we have
previously seen, doing so can easily result in OOB reads and writes in
the subsequent thread of execution.

The current suggestion from one of the HID maintainers is to remove the
memset() and simply return if the incoming event buffer size is not
large enough to fill the associated report.

Suggested-by Benjamin Tissoires <bentiss>

[bentiss: changed the return value]
Comment 1 Keith Grant 2026-05-01 18:31:53 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026050106-CVE-2026-43048-ec58@gregkh/T