CVE-2026-89999: HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
HID: wacom: validate report length in wacomintuospro2btirq
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Configuration
Implement the fix by validating the Bluetooth HID report length in wacom_intuos_pro2_bt_irq() (and similarly guard wacom_intuos_pro2_bt_irq parsing) so that short/undersized reports that still pass the report-id gate are rejected before sub-parsers dereference wacom->data at fixed offsets (e.g., minimum 286 bytes for INTUOSP2_BT/INTUOSP2S_BT and minimum 46 bytes for the gen3 branch).
Linux kernel HID: Wacom validate report length before parsing in wacom_intuos_pro2_bt_irq() = reject malformed reports with insufficient length (early bail out) before any sub-parser dereference
Event History
Frequently Asked Questions
Which device variants are affected by the missing length validation?
The affected parsing paths are INTUOSP2_BT and INTUOSP2S_BT, which require reports of at least 286 bytes, and INTUOSHT3_BT (“gen3”), which requires reports of at least 46 bytes. The device type is selected from the VID/PID id_table entry.
What occurs when a report is shorter than the parser expects?
After the report-ID check, the handler invokes fixed-offset sub-parsers without passing or checking the received report length. A short report can therefore cause accesses beyond the available report data, including data[285] on the Pro2 paths and data[45] on the gen3 path.
Does registering the relevant input interfaces depend on receiving a full report?
No. wacom_setup_device_quirks() force-registers the pen, pad, and touch inputs for the selected device type independently of the report length.