CVE-2026-98499
Received Received - Intake

Out-of-Bounds Read in Linux Kernel HID Wacom Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an invalid offset to hid_field_extract(), resulting in memory reads at incorrect addresses -- possibly beyond the end of the report. If a field in the HID descriptor lists more usages than its Report Count actually reserves space for, the function's inner 'j' will walk past the end of the field: for (i = 0; i < report->maxfield; i++) { for (j = 0; j < report->field[i]->maxusage; j++) { ... value = hid_field_extract(hdev, raw_data + 1, offset + j * size, size); A descriptor listing 12288 usages against Report Count 1 has the loop extract the usage at index 12287 from bit offset 98296 -- about 12 KB past a 2-byte received report. The value is stored in wacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event, making this an information disclosure. Clamp the loop to field->report_count, the number of value slots the report holds. Value slots past the last declared usage are still scanned; they reuse that usage (HID 1.11, 6.2.2.8). Verified on v6.12.105 with a UHID reproducer: a 2-byte report from such a descriptor trips KASAN before the patch and not after it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98499
EUVD
EUVD-2026-103739

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 83417206427bdf0fef9fa69957807194f25923c3
Linux Linux 83417206427bdf0fef9fa69957807194f25923c3
Linux Linux 83417206427bdf0fef9fa69957807194f25923c3
Linux Linux 83417206427bdf0fef9fa69957807194f25923c3
Linux Linux 83417206427bdf0fef9fa69957807194f25923c3
Linux Linux 83417206427bdf0fef9fa69957807194f25923c3
Linux Linux 83417206427bdf0fef9fa69957807194f25923c3
Linux Linux 83417206427bdf0fef9fa69957807194f25923c3
Linux Linux 4.16

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds (OOB) read in the Linux kernel's HID subsystem, specifically in the wacom_wac_pen_serial_enforce() function. It occurs when the function calculates an invalid offset for memory reads due to a mismatch between the number of usages listed in a HID descriptor and the actual space reserved in the report. This can lead to reading memory beyond the end of the report, potentially exposing sensitive data.

Detection Guidance

This vulnerability is specific to the Linux kernel's HID wacom driver and requires a malformed HID descriptor to trigger. Detection involves checking kernel logs for KASAN reports or scanning for devices with suspicious HID descriptors. Use dmesg | grep -i kasan or lsusb to identify potential issues.

Impact Analysis

This vulnerability could allow an attacker to read memory contents beyond the intended report boundaries. If exploited, it may disclose sensitive information from the kernel, such as serial numbers or other data stored in memory. The impact is limited to systems using vulnerable Wacom HID devices and depends on the specific configuration and data processed by the device.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-98499. If immediate patching is not possible, disable the wacom driver or restrict access to HID devices until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98499. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart