CVE-2026-64366

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert

wacom_wac_queue_insert() calls kfifo_skip() in a loop when the kfifo

doesn't have enough space for the incoming report. If the kfifo is

empty, kfifo_skip() reads stale data left in the kmalloc'd buffer

via __kfifo_peek_n() and interprets it as a record length, advancing

fifo->out by that garbage value. This corrupts the internal kfifo

state, causing kfifo_unused() to return a value much larger than the

actual buffer size, which bypasses __kfifo_in_r()'s guard:

if (len + recsize > kfifo_unused(fifo))

return 0;

kfifo_copy_in() then performs an out-of-bounds memcpy, writing up to

3842 bytes past the 256-byte buffer.

Add a !kfifo_is_empty() condition to the while loop so kfifo_skip()

is never called on an empty fifo, and check the return value of

kfifo_in() to reject reports that are too large for the fifo.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References