PT-2026-61233 · Linux · Linux

CVE-2026-63916 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: Fix OOB write in wacom hid set device mode()

wacom hid set device mode() currently assumes that the HID DG INPUTMODE usage is always located in the first field (field[0]) of the feature report. However, a device can specify HID DG INPUTMODE in a different field.

If HID DG INPUTMODE is in a field other than the first one and the first field has a report count smaller than the usage index of HID DG INPUTMODE, this leads to an out-of-bounds write to r->field[0]->value.

Fix this by storing the field index of HID DG INPUTMODE in 'struct hid data' during feature mapping. In wacom hid set device mode(), use this stored field index to access the correct field and add bounds checks to ensure both the field index and the value index are within valid ranges before writing.

Fix

Related Identifiers

CVE-2026-63916

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-63916 · Security Note
• https://git.kernel.org/stable/c/b8338111e14183972359009c12d0dbd81d2e1e16 · Note
• https://git.kernel.org/stable/c/43e7c02d6090a82fd60d63491f6871aec906345e · Note
• https://git.kernel.org/stable/c/ed598de9f61582902406d352d99f2073d8e00298 · Note
• https://git.kernel.org/stable/c/5716a293fb19d382ca2336e08fd28a619a5f3c25 · Note
• https://git.kernel.org/stable/c/83bd8a5756a3c4a413ed8f6253f9eb2821e1ccaf · Note
• https://git.kernel.org/stable/c/c0a8899e02ddebd51e2589835182c239c2e224ae · Note
• https://git.kernel.org/stable/c/5db3fca0cec7b33bc5379411d0a60d792c9f9bc0 · Note
• https://git.kernel.org/stable/c/2add311d99646c9d235b2c44f9c169ba30f5db3a · Note