CVE-2026-64366: HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: fix slab-out-of-bounds write in wacomwacqueueinsert
wacomwacqueueinsert() calls kfifoskip() in a loop when the kfifo doesn't have enough space for the incoming report. If the kfifo is empty, kfifoskip() reads stale data left in the kmalloc'd buffer via kfifopeekn() and interprets it as a record length, advancing fifo->out by that garbage value. This corrupts the internal kfifo state, causing kfifounused() to return a value much larger than the actual buffer size, which bypasses kfifoinr()'s guard:
if (len + recsize > kfifounused(fifo)) return 0;
kfifocopyin() then performs an out-of-bounds memcpy, writing up to 3842 bytes past the 256-byte buffer.
Add a !kfifoisempty() condition to the while loop so kfifoskip() is never called on an empty fifo, and check the return value of kfifoin() to reject reports that are too large for the fifo.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector identifies adjacent-network attack access (AV:A), with no privileges or user interaction required. Exploitation involves supplying HID reports that drive the Wacom driver's FIFO handling into the vulnerable state.
What is the potential impact if exploitation succeeds?
The flaw can corrupt the Wacom driver's internal FIFO state and cause an out-of-bounds memory write. The reported write can extend up to 3842 bytes beyond a 256-byte buffer, and the CVSS rating indicates high confidentiality, integrity, and availability impact.
What change resolves the vulnerable behavior?
The fix prevents kfifo_skip() from being called when the FIFO is empty and rejects reports that are too large for the FIFO by checking the kfifo_in() return value.