---
id: CVE-2026-98499
title: 'HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()

  The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an
  invalid offset to hid_field_extract(…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 83417206427bdf0fef9fa69957807194f25923c3 <
    9aa62f967b6a4bb30aa3b778e02c8a5ca6bcde51
  - >-
    Linux >= 83417206427bdf0fef9fa69957807194f25923c3 <
    26471d954bbfbfb9032994f7f485802ee20e0582
  - >-
    Linux >= 83417206427bdf0fef9fa69957807194f25923c3 <
    456afe4707e23cc114ad833197f63b52bb8fd1e7
  - >-
    Linux >= 83417206427bdf0fef9fa69957807194f25923c3 <
    65e7c4b5366b770c60dfefac3f1d06e33a9e411e
  - >-
    Linux >= 83417206427bdf0fef9fa69957807194f25923c3 <
    eaa7d29341ef4b91e84ad097562982288a7c376c
  - >-
    Linux >= 83417206427bdf0fef9fa69957807194f25923c3 <
    c3129e6f26e18c0886ede7265f187a7ec289e1d1
  - >-
    Linux >= 83417206427bdf0fef9fa69957807194f25923c3 <
    4b09b7c84b8633cd041181616bd15bf5e73c164d
  - >-
    Linux >= 83417206427bdf0fef9fa69957807194f25923c3 <
    9aa237cf66495b2426ddde8532e9b08a0ed83aaa
  - Linux 4.16
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:16:31.629Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98499'
references:
  - url: 'https://git.kernel.org/stable/c/9aa62f967b6a4bb30aa3b778e02c8a5ca6bcde51'
  - url: 'https://git.kernel.org/stable/c/26471d954bbfbfb9032994f7f485802ee20e0582'
  - url: 'https://git.kernel.org/stable/c/456afe4707e23cc114ad833197f63b52bb8fd1e7'
  - url: 'https://git.kernel.org/stable/c/65e7c4b5366b770c60dfefac3f1d06e33a9e411e'
  - url: 'https://git.kernel.org/stable/c/eaa7d29341ef4b91e84ad097562982288a7c376c'
  - url: 'https://git.kernel.org/stable/c/c3129e6f26e18c0886ede7265f187a7ec289e1d1'
  - url: 'https://git.kernel.org/stable/c/4b09b7c84b8633cd041181616bd15bf5e73c164d'
  - url: 'https://git.kernel.org/stable/c/9aa237cf66495b2426ddde8532e9b08a0ed83aaa'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.291Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()

The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an
invalid offset to hid_field_extract(), resulting in memory reads at
incorrect addresses -- possibly beyond the end of the report.  If a
field in the HID descriptor lists more usages than its Report Count
actually reserves space for, the function's inner 'j' will walk past
the end of the field:

	for (i = 0; i < report->maxfield; i++) {
		for (j = 0; j < report->field[i]->maxusage; j++) {
			...
			value = hid_field_extract(hdev, raw_data + 1,
						  offset + j * size, size);

A descriptor listing 12288 usages against Report Count 1 has the loop
extract the usage at index 12287 from bit offset 98296 -- about 12 KB
past a 2-byte received report.  The value is stored in
wacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event,
making this an information disclosure.

Clamp the loop to field->report_count, the number of value slots the
report holds.  Value slots past the last declared usage are still
scanned; they reuse that usage (HID 1.11, 6.2.2.8).

Verified on v6.12.105 with a UHID reproducer: a 2-byte report from
such a descriptor trips KASAN before the patch and not after it.

## Affected

- `Linux >= 83417206427bdf0fef9fa69957807194f25923c3 < 9aa62f967b6a4bb30aa3b778e02c8a5ca6bcde51`
- `Linux >= 83417206427bdf0fef9fa69957807194f25923c3 < 26471d954bbfbfb9032994f7f485802ee20e0582`
- `Linux >= 83417206427bdf0fef9fa69957807194f25923c3 < 456afe4707e23cc114ad833197f63b52bb8fd1e7`
- `Linux >= 83417206427bdf0fef9fa69957807194f25923c3 < 65e7c4b5366b770c60dfefac3f1d06e33a9e411e`
- `Linux >= 83417206427bdf0fef9fa69957807194f25923c3 < eaa7d29341ef4b91e84ad097562982288a7c376c`
- `Linux >= 83417206427bdf0fef9fa69957807194f25923c3 < c3129e6f26e18c0886ede7265f187a7ec289e1d1`
- `Linux >= 83417206427bdf0fef9fa69957807194f25923c3 < 4b09b7c84b8633cd041181616bd15bf5e73c164d`
- `Linux >= 83417206427bdf0fef9fa69957807194f25923c3 < 9aa237cf66495b2426ddde8532e9b08a0ed83aaa`
- `Linux 4.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.