IT SBIT Services
Schneeberger
DEEN
CVE tracker

Linux kernel: Out-of-bounds read in Wacom HID driver

CVE-2026-98499High 8.1

← All vulnerabilities

Summary

The Wacom HID driver in the Linux kernel can read past the end of a received HID report when a crafted HID descriptor lists more usages than its Report Count reserves. The value read is stored in the pen serial data and can be passed to userspace as an MSC_SERIAL event. An attacker needs to attach a crafted USB HID device or have UHID access, so this is a local or physical-proximity issue that leads to information disclosure.

Affected

  • Linux kernel stable branches from 4.16 onward, depending on the branch (CVE record and OSV ranges differ; check your exact branch)
  • Unknown whether every listed branch is affected before the fixed versions

Fixed in

  • 5.10.271
  • 5.15.222
  • 6.1.189
  • 6.6.158
  • 6.12.112
  • 6.18.55
  • 7.2.9
  • Distribution kernels: check the vendor advisory for your release (Alpaquita: 6.1.189-r0, 6.12.112-r0, 6.18.55-r0)

Workaround

  • No vendor workaround known.
  • On systems without Wacom tablets, remove or block the Wacom driver module (verify the module name first).
  • Restrict unknown USB and Bluetooth devices, for example with USBGuard.

Exploitation

  • No known exploitation in the wild.
  • EPSS 0.0021.
  • No public proof of concept found.

Our recommendation

  • Apply the kernel update from your distribution or the stable branch in the normal patch cycle.
  • Prioritise shared workstations, reception or kiosk PCs and design workstations with Wacom tablets.
  • Restrict physical USB access for untrusted persons and apply the workarounds above where Wacom hardware is not needed.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:47.

Original description (NVD)

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an invalid offset to hid_field_extract(), resulting in memory reads at incorrect addresses -- possibly beyond the end of the report. If a field in the HID descriptor lists more usages than its Report Count actually reserves space for, the function's inner 'j' will walk past the end of the field: for (i = 0; i < report->maxfield; i++) { for (j = 0; j < report->field[i]->maxusage; j++) { ... value = hid_field_extract(hdev, raw_data + 1, offset + j * size, size); A descriptor listing 12288 usages against Report Count 1 has the loop extract the usage at index 12287 from bit offset 98296 -- about 12 KB past a 2-byte received report. The value is stored in wacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event, making this an information disclosure. Clamp the loop to field->report_count, the number of value slots the report holds. Value slots past the last declared usage are still scanned; they reuse that usage (HID 1.11, 6.2.2.8). Verified on v6.12.105 with a UHID reproducer: a 2-byte report from such a descriptor trips KASAN before the patch and not after it.

NVD references (8)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed