{"id":"CVE-2026-98499","kind":"vulnerability","aliases":["CVE-2026-98499"],"related":[],"title":"Linux kernel: Wacom HID driver reads past report, leaks memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()\n\nThe 'wacom_wac_pen_serial_enforce()' function may calculate and pass an\ninvalid offset to hid_field_extract(), resulting in memory reads at\nincorrect addresses -- possibly beyond the end of the report.  If a\nfield in the HID descriptor lists more usages than its Report Count\nactually reserves space for, the function's inner 'j' will walk past\nthe end of the field:\n\n\tfor (i = 0; i < report->maxfield; i++) {\n\t\tfor (j = 0; j < report->field[i]->maxusage; j++) {\n\t\t\t...\n\t\t\tvalue = hid_field_extract(hdev, raw_data + 1,\n\t\t\t\t\t\t  offset + j * size, size);\n\nA descriptor listing 12288 usages against Report Count 1 has the loop\nextract the usage at index 12287 from bit offset 98296 -- about 12 KB\npast a 2-byte received report.  The value is stored in\nwacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event,\nmaking this an information disclosure.\n\nClamp the loop to field->report_count, the number of value slots the\nreport holds.  Value slots past the last declared usage are still\nscanned; they reuse that usage (HID 1.11, 6.2.2.8).\n\nVerified on v6.12.105 with a UHID reproducer: a 2-byte report from\nsuch a descriptor trips KASAN before the patch and not after it.","summary":"A malicious or malformed USB HID device with a crafted descriptor can make the Wacom driver read memory beyond the end of a received report. The leaked value is reported to userspace as an MSC_SERIAL input event, so an attacker gets kernel memory contents as information disclosure.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-linux","hid","infrastructure","linux-kernel","server-linux","wacom"],"not_affected_if":["module-not-loaded","no-wacom-hardware"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel version in your distribution's advisory (unknown in the sources)\n- Check whether the Wacom HID driver is loaded with `lsmod | grep wacom`","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing wacom_wac_pen_serial_enforce() (fixed version: unknown in the sources)\n- Until patched, unload the driver with `modprobe -r wacom` if no Wacom tablet is in use","status":"open","published_at":"2026-10-18T16:17:00+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:35+00:00","updated_at":"2026-10-25T05:25:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:25:35Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing wacom_wac_pen_serial_enforce() (fixed version: unknown in the sources)\n- Until patched, unload the driver with `modprobe -r wacom` if no Wacom tablet is in use","reach":"local","title":"Linux kernel: Wacom HID driver reads past report, leaks memory","impact":"low","summary":"A malicious or malformed USB HID device with a crafted descriptor can make the Wacom driver read memory beyond the end of a received report. The leaked value is reported to userspace as an MSC_SERIAL input event, so an attacker gets kernel memory contents as information disclosure.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","hid","wacom","desktop-linux","server-linux"],"confidence":0.6,"needs_auth":"no","worst_case":"kernel memory contents leak to userspace via serial events","analyst_note":"Find the fixed kernel versions and stable backport commit in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98499 or the kernel.org stable commit log.","how_to_check":"- Run `uname -r` and compare against the fixed kernel version in your distribution's advisory (unknown in the sources)\n- Check whether the Wacom HID driver is loaded with `lsmod | grep wacom`","needs_analyst":true,"not_affected_if":["no-wacom-hardware","module-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the Wacom HID driver that can receive reports from a Wacom-style pen tablet, including devices an attacker can plug in or emulate through UHID. Machines without Wacom tablets or with the module not loaded are less exposed. The sources do not say which kernel versions are fixed beyond the v6.12.105 reproduction.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000717,"input_tokens":3720,"output_tokens":689,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98499':13A,16A '0':163C,170C,228C '1':184C,197C '1.11':273C '12':212C '12287':206C '12288':192C '2':216C,283C '6.2.2.8':274C '98296':210C 'actual':144C 'address':122C 'attack':69B 'beyond':47B,124C 'bit':208C 'byte':217C,284C 'calcul':106C 'clamp':243C 'content':73B 'count':143C,196C,249C 'craft':38B 'cve':11A,14A 'data':183C 'declar':263C 'descriptor':39B,136C,190C,289C 'desktop':18B 'desktop-linux':17B 'devic':35B 'disclosur':76B,242C 'driver':5A,44B 'end':49B,126C,157C 'enforc':97C,103C 'event':66B,237C 'extract':115C,180C,201C 'field':114C,132C,160C,173C,179C,247C 'fix':89C 'follow':82C 'function':104C,149C 'get':70B 'hdev':181C 'hid':4A,20B,34B,87C,113C,135C,178C,272C 'hold':257C 'incorrect':121C 'index':205C 'inform':75B,241C 'infrastructur':21B 'inner':151C 'input':65B 'invalid':110C 'j':152C,169C,171C,176C,186C 'kasan':291C 'kb':213C 'kernel':2A,24B,71B,80C 'last':262C 'leak':9A,55B 'linux':1A,19B,23B,27B,79C 'linux-kernel':22B 'list':137C,191C 'loop':200C,245C 'make':41B,238C 'malform':32B 'malici':30B 'maxfield':166C 'maxusag':175C 'may':105C 'memori':10A,46B,72B,118C 'msc':63B,235C 'number':251C 'offset':111C,185C,209C 'oob':90C 'pass':108C 'past':7A,155C,214C,260C 'patch':294C 'pen':95C,101C 'possibl':123C 'raw':182C 'reach':231C 'read':6A,45B,91C,119C 'receiv':52B,218C 'report':8A,53B,58B,129C,142C,165C,172C,195C,219C,248C,256C,285C 'reproduc':281C 'reserv':145C 'resolv':86C 'result':116C 'reus':269C 'scan':267C 'serial':64B,96C,102C,227C,236C 'server':26B 'server-linux':25B 'size':187C,188C 'slot':254C,259C 'space':146C 'still':266C 'store':223C 'trip':290C 'uhid':280C 'usag':139C,193C,203C,264C,271C 'usb':33B 'userspac':60B,232C 'v6.12.105':277C 'valu':56B,177C,221C,253C,258C 'verifi':275C 'vulner':83C 'wac':94C,100C,226C 'wacom':3A,28B,43B,88C,93C,99C,225C 'walk':154C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Wacom HID driver that can receive reports from a Wacom-style pen tablet, including devices an attacker can plug in or emulate through UHID. Machines without Wacom tablets or with the module not loaded are less exposed. The sources do not say which kernel versions are fixed beyond the v6.12.105 reproduction.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98499","severity":null,"published_at":"2026-10-18T16:17:00+00:00","modified_at":"2026-10-19T10:19:02+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}