---
id: CVE-2026-64366
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert

  wacom_wac_queue_insert() calls kfifo_skip() in a loop when the kfifo
  doesn't have enough space for t…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert

  wacom_wac_queue_insert() calls kfifo_skip() in a loop when the kfifo
  doesn't have enough space for t…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
published: '2026-07-25'
updated: '2026-07-27'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64366'
references:
  - url: 'https://git.kernel.org/stable/c/57bdd10ad50d68341f500a7b330f0d8949e510ec'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6b3014ec0e9a390ca563030b2d7689921f0daef5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ca899a926c11a59211b764b0155d9a1cdcc32b81'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00253
epssPercentile: 0.1715
ingestedAt: '2026-07-27T06:16:50.759Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert

wacom_wac_queue_insert() calls kfifo_skip() in a loop when the kfifo
doesn't have enough space for the incoming report. If the kfifo is
empty, kfifo_skip() reads stale data left in the kmalloc'd buffer
via __kfifo_peek_n() and interprets it as a record length, advancing
fifo->out by that garbage value. This corrupts the internal kfifo
state, causing kfifo_unused() to return a value much larger than the
actual buffer size, which bypasses __kfifo_in_r()'s guard:

  if (len + recsize > kfifo_unused(fifo))
      return 0;

kfifo_copy_in() then performs an out-of-bounds memcpy, writing up to
3842 bytes past the 256-byte buffer.

Add a !kfifo_is_empty() condition to the while loop so kfifo_skip()
is never called on an empty fifo, and check the return value of
kfifo_in() to reject reports that are too large for the fifo.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.