The Linux kernel’s Wacom HID driver contains a flaw that allows the driver to perform an out‑of‑bounds write during packet processing. When the kfifo buffer is empty, a loop incorrectly calls kfifo_skip, which interprets stale memory as a record length and advances the FIFO pointer beyond the kmalloc‑allocated 256‑byte buffer. This corrupts the internal FIFO state, bypassing the length check and enabling a memcpy that writes up to 3,842 bytes past the buffer. The resulting memory corruption can overwrite arbitrary kernel data, potentially leading to denial‑of‑service or privilege escalation for a local user with access to a Wacom device.

All installations of the Linux kernel that include the default Wacom HID driver and have not applied the patch commits (c6b3014ec0e9a390ca563030b2d7689921f0daef5 and 57bdd10ad50d68341f500a7b330f0d8949e510ec) are potentially affected. The advisory does not list specific kernel releases, so any kernel that still uses the vulnerable driver code is at risk.

The CVSS score of 8.8 indicates a high severity, but the EPSS score of less than 1% and the lack of a CISA KEV listing suggest a low probability of active exploitation. The vulnerability requires local access to a Wacom HID device and does not involve network attack vectors. A successful exploit can corrupt kernel memory, leading to crashes or privilege gain, but patching removes the risk entirely.