Executive brief
The Linux kernel's wacom tablet driver contains a memory allocation bug in the wacom_wac_queue_flush() function. This function is called from USB device interrupt handling (atomic context), but was using GFP_KERNEL which can sleep, causing a "scheduling while atomic" kernel panic. The bug affects systems using Wacom USB input devices and requires a kernel patch to fix.
Technical details
The vulnerability is a scheduling-while-atomic bug in the wacom HID driver. wacom_wac_queue_flush() is invoked via the .raw_event callback (wacom_raw_event → wacom_wac_pen_serial_enforce → wacom_wac_queue_flush), which for USB HID devices runs in atomic context within the hid_irq_in() URB completion handler. The vulnerable code used kzalloc(size, GFP_KERNEL), which can sleep and trigger a kernel BUG. The fix changes the allocation flag to GFP_ATOMIC, which does not sleep. The existing error handling already gracefully skips the FIFO entry if allocation fails, so the change is safe. This affects all Linux kernels with the vulnerable code path introduced by commit 5e013ad20689.
Affected products
- Linux Linux kernel All versions with commit 5e013ad20689 and later, prior to fix
Timeline
- 2026-08-10: disclosed: Published on NVD
- 2026-06-01: patched: Fix committed upstream (commit 55f1ad573e34abf9a0443c34bc5a63d74edba7d7)