CVE-2026-98499: OOB read in Wacom HID drivers

CVSS 8.1: OOB read in Linux kernel Wacom HID driver causes information disclosure via MSC_SERIAL events.

CVE-2026-98499 is an out-of-bounds read in the wacom_wac_pen_serial_enforce() function of the Linux kernel Wacom HID driver. The vulnerability occurs when an HID descriptor declares more usages than the actual Report Count reserves space for. This allows the inner loop to access beyond report boundaries, reading arbitrary memory at offsets up to 12 KB away from a 2-byte received report. The read memory is then exposed to userspace through MSC_SERIAL events, constituting direct information disclosure to system administrators and device users.

The vulnerability has a CVSS score of 8.1 (High). It was verified on v6.12.105 using a KASAN reproducer, confirming the fault nature. A GitHub signal dated November 7, 2026 reports this vulnerability, indicating awareness spread. The fix is already implemented in the kernel: the loop is clamped to field->report_count, restricting access to allocated report space only. Status: patch available and verified.

System administrators and IT teams must prioritize applying Linux kernel updates that include the CVE-2026-98499 fix, especially on systems using Wacom HID devices (tablets, digital pens, etc.). Verify the current kernel version and consult your Linux distribution's security advisories for patched packages. Monitor system logs for anomalies and restrict HID device access to necessary users and services, applying least privilege principles.

At a glance

What: Out-of-bounds read in wacom_wac_pen_serial_enforce() function of Linux kernel Wacom HID driver. HID descriptors with more declared usages than Report Count cause memory access beyond report boundaries.
Severity: CVSS 8.1 (High). Information disclosure: arbitrary memory readable from userspace via MSC_SERIAL events.
Affected versions: v6.12.105 confirmed vulnerable. Other kernel versions on 6.x series with unpatched Wacom HID driver affected.
Fix: Clamp inner loop to field->report_count to restrict access to actually allocated value slots in the report.
Status: Patch available and verified with KASAN reproducer. Fix implemented in updated kernels.
Action: Apply Linux kernel updates, verify version with uname -r, consult Linux distribution security advisories, monitor HID devices, apply least privilege.

Sources: NVD, CVE-2026-98499

← All articles