CVE-2026-98499

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()

The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an

invalid offset to hid_field_extract(), resulting in memory reads at

incorrect addresses -- possibly beyond the end of the report. If a

field in the HID descriptor lists more usages than its Report Count

actually reserves space for, the function's inner 'j' will walk past

the end of the field:

for (i = 0; i < report->maxfield; i++) {

for (j = 0; j < report->field[i]->maxusage; j++) {

...

value = hid_field_extract(hdev, raw_data + 1,

offset + j * size, size);

A descriptor listing 12288 usages against Report Count 1 has the loop

extract the usage at index 12287 from bit offset 98296 -- about 12 KB

past a 2-byte received report. The value is stored in

wacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event,

making this an information disclosure.

Clamp the loo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References