The Linux kernel's HID wacom driver contained a vulnerability where wacom_wac_queue_insert() calls kfifo_skip() in a loop without checking if the kfifo buffer is empty. When the kfifo is empty, kfifo_skip() reads stale data from the kmalloc'd buffer, misinterpreting it as a record length and corrupting the internal kfifo state. This causes kfifo_unused() to return an incorrect large value, bypassing the guard in __kfifo_in_r(), which leads to kfifo_copy_in() performing an out-of-bounds memcpy that can write up to 3842 bytes beyond the 256-byte buffer. The fix adds a condition to ensure kfifo_skip() is never called on an empty fifo and checks the return value of kfifo_in() to reject oversized reports. This vulnerability is tracked as CVE-2026-64366 and affects Linux kernel versions prior to the fixed releases listed in the Ubuntu advisories.

This vulnerability allows an out-of-bounds write in kernel memory, which can lead to corruption of kernel data structures, potentially causing system instability, crashes, or privilege escalation. The CVSS score of 8.8 indicates high severity with high impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

A patch is available and has been released by Ubuntu in their Linux kernel updates. Users should update their systems to the fixed kernel versions as specified in the Ubuntu security notices USN-8726-1 and USN-8727-1. After applying the update, a system reboot is required. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Following the vendor's update instructions will mitigate this vulnerability.