CVE-2026-68087: HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: use GFPATOMIC in wacomwacqueueflush()
wacomwacqueueflush() is called via the .rawevent callback (wacomrawevent → wacomwacpenserialenforce → wacomwacqueueflush). For USB HID devices, this callback is invoked from hidirqin(), which is a URB completion handler running in atomic context. Using GFPKERNEL in this path can sleep, leading to a "scheduling while atomic" bug.
Use GFPATOMIC instead. The existing code already handles allocation failure by skipping the fifo entry and continuing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update wacom_wac_queue_flush() (invoked via the hid .raw_event callback / wacom_raw_event → wacom_wac_pen_serial_enforce → wacom_wac_queue_flush) to use GFP_ATOMIC instead of GFP_KERNEL to avoid 'scheduling while atomic' when running in atomic context (e.g., URB completion handler).
Linux kernel (HID: wacom) GFP flag used in wacom_wac_queue_flush() allocation = GFP_ATOMIC
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68087?
CVE-2026-68087 has a risk rating of 12, indicating a critical vulnerability.
How do I fix CVE-2026-68087?
To fix CVE-2026-68087, update to the latest patched version of the Linux kernel provided by your distribution.
What systems are affected by CVE-2026-68087?
CVE-2026-68087 affects the Linux kernel when handling USB HID devices, particularly with Wacom tablets.
What type of vulnerability is CVE-2026-68087?
CVE-2026-68087 is a resource allocation vulnerability in the Linux kernel related to memory management.
When was CVE-2026-68087 published?
CVE-2026-68087 was published on August 10, 2026.