Executive brief
A vulnerability in the Linux kernel's Wacom tablet driver could allow a malicious or malformed device to cause a system crash. The issue occurs when the driver incorrectly handles how certain tablet settings are stored in memory, leading to an out-of-bounds write. This could potentially impact system stability or be used to gain unauthorized access if a user connects a specially crafted device.
Technical details
An out-of-bounds (OOB) write exists in the Wacom HID driver within the wacom_hid_set_device_mode() function. The driver incorrectly assumed that the HID_DG_INPUTMODE usage was always located in the first field (field[0]) of a feature report. If a device specifies this usage in a different field where the first field's report_count is smaller than the usage_index, the driver performs an OOB write to r->field[0]->value. This can be triggered by a malicious HID device or a device with malformed descriptors. The fix introduces proper tracking of the field index and adds bounds checking for both the field and value indices.
Affected products
- Linux Linux Kernel 5ae6e89f7409 to 2add311d9964, 83bd8a5756a3, 5716a293fb19, ed598de9f615, 43e7c02d6090, b8338111e141, 5db3fca0cec7, c0a8899e02dde
Timeline
- 2026-07-19: advisory: CVE-2026-63916 published by NVD
- 2026-06-19: patched: Fix committed to Linux stable tree
References
- https://git.kernel.org/stable/c/2add311d99646c9d235b2c44f9c169ba30f5db3a
- https://git.kernel.org/stable/c/43e7c02d6090a82fd60d63491f6871aec906345e
- https://git.kernel.org/stable/c/5716a293fb19d382ca2336e08fd28a619a5f3c25
- https://git.kernel.org/stable/c/5db3fca0cec7b33bc5379411d0a60d792c9f9bc0
- https://git.kernel.org/stable/c/83bd8a5756a3c4a413ed8f6253f9eb2821e1ccaf
- https://git.kernel.org/stable/c/b8338111e14183972359009c12d0dbd81d2e1e16
- https://git.kernel.org/stable/c/c0a8899e02ddebd51e2589835182c239c2e224ae