In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() The… (CVE-2026-98499)

The Linux kernel's HID wacom driver contained a vulnerability in the wacom_wac_pen_serial_enforce() function where an invalid offset could be passed to hid_field_extract(), causing out-of-bounds memory reads. This occurred when a HID descriptor listed more usages than the Report Count reserved space for, allowing the inner loop to read memory beyond the report's end. Specifically, a descriptor with 12288 usages against a Report Count of 1 caused the function to read approximately 12 KB past a 2-byte report. The read value could be stored and exposed to userspace as an MSC_SERIAL event, resulting in information disclosure. The fix clamps the loop to the field's report_count, ensuring only valid memory is accessed. The vulnerability was verified on Linux kernel version 6.12.105 using a UHID reproducer that triggered KASAN before the patch and not after.

The vulnerability allows an attacker to cause the kernel to read memory beyond the intended buffer, potentially disclosing sensitive information to userspace via MSC_SERIAL events. There is no indication of code execution or privilege escalation. The impact is limited to information disclosure through out-of-bounds reads.

A fix is available that clamps the loop in wacom_wac_pen_serial_enforce() to the field's report_count, preventing out-of-bounds reads. Users should apply the official Linux kernel patch that addresses this issue. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation.