The vulnerability is an out‑of‑bounds write in the Linux kernel’s Wacom HID driver, specifically in wacom_hid_set_device_mode(). The code assumes that the HID_DG_INPUTMODE usage always appears in the first field of a feature report, but devices can place this usage elsewhere. When the first field’s report_count is smaller than the usage index of HID_DG_INPUTMODE, the driver writes beyond the end of the r->field[0]->value buffer. This overflow corrupts kernel memory and is a classic CWE‑787 (Out‑of‑Bounds Write).

All Linux kernel builds that include the unpatched wacom_hid.c driver are affected. Because no specific version ranges are supplied by the CNA, any kernel prior to the inclusion of the patch that stores the correct field index and performs bounds checks is potentially vulnerable. The issue resides solely within the kernel module that handles Human Interface Devices for Wacom products.

The CVSS score of 8.8 classifies this flaw as high severity, while the EPSS score of less than 1% indicates a very low probability of public exploitation at this time. The vulnerability is not in the CISA KEV catalog. Based on the description, it is inferred that the attacker must supply a malicious USB Wacom device that places HID_DG_INPUTMODE in a non‑first field. The likely attack vector is physical USB insertion; once the out‑of‑bounds write occurs, the attacker can corrupt kernel memory, potentially executing arbitrary code in kernel mode and elevating privileges. In environments where USB devices are physically accessible, the risk remains tangible.