CVE-2026-98499 - Vulnerability Details

- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()

The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an
invalid offset to hid_field_extract(), resulting in memory reads at
incorrect addresses -- possibly beyond the end of the report. If a
field in the HID descriptor lists more usages than its Report Count
actually reserves space for, the function's inner 'j' will walk past
the end of the field:

for (i = 0; i < report->maxfield; i++) {
for (j = 0; j < report->field[i]->maxusage; j++) {
...
value = hid_field_extract(hdev, raw_data + 1,
offset + j * size, size);

A descriptor listing 12288 usages against Report Count 1 has the loop
extract the usage at index 12287 from bit offset 98296 -- about 12 KB
past a 2-byte received report. The value is stored in
wacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event,
making this an information disclosure.

Clamp the loop to field->report_count, the number of value slots the
report holds. Value slots past the last declared usage are still
scanned; they reuse that usage (HID 1.11, 6.2.2.8).

Verified on v6.12.105 with a UHID reproducer: a 2-byte report from
such a descriptor trips KASAN before the patch and not after it.

Published: 2026-10-18

Score: 8.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The kernel driver for Wacom HID devices contains a logic error where it may calculate an invalid offset when extracting a report usage field. During processing of an HID descriptor that advertises more usages than the report actually supports, the driver reads past the end of the received report. The out‑of‑bounds data is copied into a kernel buffer and then exposed to user space through an MSC_SERIAL event, which can leak kernel memory to an attacker. This flaw allows an adversary to read sensitive data from the kernel, compromising confidentiality.

Affected Systems

All Linux kernel releases built before the patch in commit 26471d9 were susceptible. The vulnerability exists in any kernel that uses the wacom HID driver without the backport or update present in Linux 6.12.105 and later releases. The issue affects devices that present an invalid HID descriptor to the OS, typically proprietary or custom stylus or tablet hardware that includes the wacom module.

Risk and Exploitability

The CVSS score is 8.1 and the EPSS score is <1%, indicating low exploitation probability. The flaw relies on a specific descriptor configuration that can be under the control of an attacker. Because the data is read from kernel memory and subsequently sent to user space, the attack requires local execution on the target machine and the ability to format a malicious HID report. The vulnerability is not present in the kernel version 6.12.105 and later, and it is not currently listed in CISA’s KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`83417206427bdf0fef9fa69957807194f25923c3`	affected	< 9aa62f967b6a4bb30aa3b778e02c8a5ca6bcde51
`83417206427bdf0fef9fa69957807194f25923c3`	affected	< 26471d954bbfbfb9032994f7f485802ee20e0582
`83417206427bdf0fef9fa69957807194f25923c3`	affected	< 456afe4707e23cc114ad833197f63b52bb8fd1e7
`83417206427bdf0fef9fa69957807194f25923c3`	affected	< 65e7c4b5366b770c60dfefac3f1d06e33a9e411e
`83417206427bdf0fef9fa69957807194f25923c3`	affected	< eaa7d29341ef4b91e84ad097562982288a7c376c
`83417206427bdf0fef9fa69957807194f25923c3`	affected	< c3129e6f26e18c0886ede7265f187a7ec289e1d1
`83417206427bdf0fef9fa69957807194f25923c3`	affected	< 4b09b7c84b8633cd041181616bd15bf5e73c164d
`83417206427bdf0fef9fa69957807194f25923c3`	affected	< 9aa237cf66495b2426ddde8532e9b08a0ed83aaa

Linux

affected

Version	Status	Constraints
`4.16`	affected	—
`0`	unaffected	< 4.16
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[83417206427bdf0fef9fa69957807194f25923c3,9aa62f967b6a4bb30aa3b778e02c8a5ca6bcde51)`	affected	code_commit	—
`[83417206427bdf0fef9fa69957807194f25923c3,26471d954bbfbfb9032994f7f485802ee20e0582)`	affected	code_commit	—
`[83417206427bdf0fef9fa69957807194f25923c3,456afe4707e23cc114ad833197f63b52bb8fd1e7)`	affected	code_commit	—
`[83417206427bdf0fef9fa69957807194f25923c3,65e7c4b5366b770c60dfefac3f1d06e33a9e411e)`	affected	code_commit	—
`[83417206427bdf0fef9fa69957807194f25923c3,eaa7d29341ef4b91e84ad097562982288a7c376c)`	affected	code_commit	—
`[83417206427bdf0fef9fa69957807194f25923c3,c3129e6f26e18c0886ede7265f187a7ec289e1d1)`	affected	code_commit	—
`[83417206427bdf0fef9fa69957807194f25923c3,4b09b7c84b8633cd041181616bd15bf5e73c164d)`	affected	code_commit	—
`[83417206427bdf0fef9fa69957807194f25923c3,9aa237cf66495b2426ddde8532e9b08a0ed83aaa)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.16`	affected	generic	—
`[0,4.16)`	unaffected	generic	—
`[5.10.271,6.0.0)`	unaffected	semver	—
`[5.15.222,6.0.0)`	unaffected	semver	—
`[6.1.189,7.0.0)`	unaffected	semver	—
`[6.6.158,7.0.0)`	unaffected	semver	—
`[6.12.112,7.0.0)`	unaffected	semver	—
`[6.18.55,7.0.0)`	unaffected	semver	—
`[7.2.9,8.0.0)`	unaffected	semver	—
`[7.3-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to 6.12.105 or newer, which contains the fixed clamp logic for the usage loop.
Reboot the system after the kernel update to ensure the patched wacom driver is loaded.
Disable or restrict the use of the affected Wacom device or replace it with a device that presents a valid HID descriptor if an update is not possible.

Generated by OpenCVE AI on October 24, 2026 at 15:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0039.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98499.mbox
https://git.kernel.org/stable/c/26471d954bbfbfb9032994f7f485802ee20e0582
https://git.kernel.org/stable/c/456afe4707e23cc114ad833197f63b52bb8fd1e7
https://git.kernel.org/stable/c/4b09b7c84b8633cd041181616bd15bf5e73c164d
https://git.kernel.org/stable/c/65e7c4b5366b770c60dfefac3f1d06e33a9e411e
https://git.kernel.org/stable/c/9aa237cf66495b2426ddde8532e9b08a0ed83aaa
https://git.kernel.org/stable/c/9aa62f967b6a4bb30aa3b778e02c8a5ca6bcde51
https://git.kernel.org/stable/c/c3129e6f26e18c0886ede7265f187a7ec289e1d1
https://git.kernel.org/stable/c/eaa7d29341ef4b91e84ad097562982288a7c376c
https://nvd.nist.gov/vuln/detail/CVE-2026-98499
https://www.cve.org/CVERecord?id=CVE-2026-98499

History

Sat, 24 Oct 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 6.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}`

Wed, 21 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98499.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98499 https://www.cve.org/CVERecord?id=CVE-2026-98499
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an invalid offset to hid_field_extract(), resulting in memory reads at incorrect addresses -- possibly beyond the end of the report. If a field in the HID descriptor lists more usages than its Report Count actually reserves space for, the function's inner 'j' will walk past the end of the field: for (i = 0; i < report->maxfield; i++) { for (j = 0; j < report->field[i]->maxusage; j++) { ... value = hid_field_extract(hdev, raw_data + 1, offset + j * size, size); A descriptor listing 12288 usages against Report Count 1 has the loop extract the usage at index 12287 from bit offset 98296 -- about 12 KB past a 2-byte received report. The value is stored in wacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event, making this an information disclosure. Clamp the loop to field->report_count, the number of value slots the report holds. Value slots past the last declared usage are still scanned; they reuse that usage (HID 1.11, 6.2.2.8). Verified on v6.12.105 with a UHID reproducer: a 2-byte report from such a descriptor trips KASAN before the patch and not after it.
Title		HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/26471d954bbfbfb9032994f7f485802ee20e0582 https://git.kernel.org/stable/c/456afe4707e23cc114ad833197f63b52bb8fd1e7 https://git.kernel.org/stable/c/4b09b7c84b8633cd041181616bd15bf5e73c164d https://git.kernel.org/stable/c/65e7c4b5366b770c60dfefac3f1d06e33a9e411e https://git.kernel.org/stable/c/9aa237cf66495b2426ddde8532e9b08a0ed83aaa https://git.kernel.org/stable/c/9aa62f967b6a4bb30aa3b778e02c8a5ca6bcde51 https://git.kernel.org/stable/c/c3129e6f26e18c0886ede7265f187a7ec289e1d1 https://git.kernel.org/stable/c/eaa7d29341ef4b91e84ad097562982288a7c376c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:16:31.629Z

Updated: 2026-10-24T14:09:08.254Z

Reserved: 2026-09-25T10:25:14.353Z

Link: CVE-2026-98499

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:00.913

Modified: 2026-10-24T14:16:44.603

Link: CVE-2026-98499

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98499 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-24T16:00:18Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object