Executive brief
A flaw in the Linux kernel's Wacom tablet driver allows a malicious or misconfigured Bluetooth device to send undersized reports that trigger out-of-bounds memory reads. An attacker with control over a paired Bluetooth peripheral can send specially crafted input that causes the driver to read and forward sensitive kernel memory bytes to userspace applications via tablet input events, potentially exposing system secrets.
Technical details
The vulnerability exists in the wacom_intuos_pro2_bt_irq() function in the HID subsystem, which parses Bluetooth reports from Wacom tablets without validating the received report length against the offsets its sub-parsers access. The function unconditionally dereferences fixed offsets in the report buffer (up to byte 285 for touchpad models, 45 for gen3 devices) without checking that the received report is long enough. An attacker can pair a spoofed Bluetooth device advertising a legitimate Wacom VID/PID and transmit an undersized report that passes the initial report-ID check but is shorter than the expected length, causing out-of-bounds reads. The driver then forwards these out-of-bounds bytes to userspace via evdev events (MSC_SERIAL, ABS_MISC, ABS_WHEEL), creating a side-channel for kernel memory leakage. A patch adds per-branch length validation before parsing, rejecting reports shorter than the maximum offset accessed on each code path.
Affected products
- Linux Linux kernel affected versions not specified in advisory
Timeline
- 2026-09-16: disclosed