PT-2026-64587 · Linux · Linux
CVE-2026-64366
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: fix slab-out-of-bounds write in wacom wac queue insert
wacom wac queue insert() calls kfifo skip() in a loop when the kfifo
doesn't have enough space for the incoming report. If the kfifo is
empty, kfifo skip() reads stale data left in the kmalloc'd buffer
via kfifo peek n() and interprets it as a record length, advancing
fifo->out by that garbage value. This corrupts the internal kfifo
state, causing kfifo unused() to return a value much larger than the
actual buffer size, which bypasses kfifo in r()'s guard:
if (len + recsize > kfifo unused(fifo))
return 0;
kfifo copy in() then performs an out-of-bounds memcpy, writing up to
3842 bytes past the 256-byte buffer.
Add a !kfifo is empty() condition to the while loop so kfifo skip()
is never called on an empty fifo, and check the return value of
kfifo in() to reject reports that are too large for the fifo.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux