Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-98499

HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an invalid offset to hid_field_extract(), resulting in memory reads at incorrect addresses -- possibly beyond the end of the report. If a field in the HID descriptor lists more usages than its Report Count actually reserves space for, the function's inner 'j' will walk past the end of the field: for (i = 0; i < report->maxfield; i++) { for (j = 0; j < report->field[i]->maxusage; j++) { ... value = hid_field_extract(hdev, raw_data + 1, offset + j * size, size); A descriptor listing 12288 usages against Report Count 1 has the loop extract the usage at index 12287 from bit offset 98296 -- about 12 KB past a 2-byte received report. The value is stored in wacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event, making this an information disclosure. Clamp the loop to field->report_count, the number of value slots the report holds. Value slots past the last declared usage are still scanned; they reuse that usage (HID 1.11, 6.2.2.8). Verified on v6.12.105 with a UHID reproducer: a 2-byte report from such a descriptor trips KASAN before the patch and not after it.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 83417206427bdf0fef9fa69957807194f25923c3 · fixed in 9aa62f967b6a4bb30aa3b778e02c8a5ca6bcde51; From 83417206427bdf0fef9fa69957807194f25923c3 · fixed in 26471d954bbfbfb9032994f7f485802ee20e0582; From 83417206427bdf0fef9fa69957807194f25923c3 · fixed in 456afe4707e23cc114ad833197f63b52bb8fd1e7; From 83417206427bdf0fef9fa69957807194f25923c3 · fixed in 65e7c4b5366b770c60dfefac3f1d06e33a9e411e; From 83417206427bdf0fef9fa69957807194f25923c3 · fixed in eaa7d29341ef4b91e84ad097562982288a7c376c; From 83417206427bdf0fef9fa69957807194f25923c3 · fixed in c3129e6f26e18c0886ede7265f187a7ec289e1d1; From 83417206427bdf0fef9fa69957807194f25923c3 · fixed in 4b09b7c84b8633cd041181616bd15bf5e73c164d; From 83417206427bdf0fef9fa69957807194f25923c3 · fixed in 9aa237cf66495b2426ddde8532e9b08a0ed83aaa

  • Linux Linux

    4.16

  • KernelLinux

    From 4.16.0 · fixed in 5.10.271; From 5.11.0 · fixed in 5.15.222; From 5.16.0 · fixed in 6.1.189; From 6.2.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.112; From 6.13.0 · fixed in 6.18.55; From 6.19.0 · fixed in 7.2.9

References 8

git.kernel.org