CVE-2026-98499: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: fix OOB read in wacomwacpenserialenforce()
The 'wacomwacpenserialenforce()' function may calculate and pass an invalid offset to hidfieldextract(), resulting in memory reads at incorrect addresses -- possibly beyond the end of the report. If a field in the HID descriptor lists more usages than its Report Count actually reserves space for, the function's inner 'j' will walk past the end of the field:
for (i = 0; i < report->maxfield; i++) { for (j = 0; j < report->field[i]->maxusage; j++) { ... value = hidfieldextract(hdev, rawdata + 1, offset + j size, size);
A descriptor listing 12288 usages against Report Count 1 has the loop extract the usage at index 12287 from bit offset 98296 -- about 12 KB past a 2-byte received report. The value is stored in wacomwac->serial[0] and can reach userspace as an MSCSERIAL event, making this an information disclosure.
Clamp the loop to field->reportcount, the number of value slots the report holds. Value slots past the last declared usage are still scanned; they reuse that usage (HID 1.11, 6.2.2.8).
Verified on v6.12.105 with a UHID reproducer: a 2-byte report from such a descriptor trips KASAN before the patch and not after it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In HID wacom handling, clamp the inner usage loop in wacom_wac_pen_serial_enforce() to field->report_count, the number of value slots the report actually reserves, rather than iterating to field->maxusage.
Event History
Frequently Asked Questions
What would an attacker need to exploit this issue?
An attacker would need to provide a malicious HID descriptor and report to the affected Wacom HID driver. The descriptor must declare more usages for a field than its Report Count reserves, causing the driver to read beyond the received report.
What is exposed if the vulnerability is exploited?
The out-of-bounds read can retrieve memory from incorrect addresses, potentially beyond the end of a HID report. The extracted value can be delivered to userspace as an MSC_SERIAL event, creating an information-disclosure path.
How can I determine whether a system is affected?
Review whether the system uses the Linux kernel Wacom HID driver and accepts or connects potentially untrusted HID devices or virtual HID devices. The issue is associated with wacom_wac_pen_serial_enforce() handling fields whose usage count exceeds their Report Count.
What is the mitigation if an update cannot be applied immediately?
Limit access to untrusted physical HID devices and prevent untrusted users or workloads from creating virtual HID devices, such as UHID devices. This reduces the opportunity to supply the malformed descriptor and report required to trigger the read.