PT-2026-64587 · Linux · Linux
CVE-2026-64366
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: fix slab-out-of-bounds write in wacom wac queue insert
wacom wac queue insert() calls kfifo skip() in a loop when the kfifo
doesn't have enough space for the incoming report. If the kfifo is
empty, kfifo skip() reads stale data left in the kmalloc'd buffer
via kfifo peek n() and interprets it as a record length, advancing
fifo->out by that garbage value. This corrupts the internal kfifo
state, causing kfifo unused() to return a value much larger than the
actual buffer size, which bypasses kfifo in r()'s guard:
if (len + recsize > kfifo unused(fifo))
return 0;
kfifo copy in() then performs an out-of-bounds memcpy, writing up to
3842 bytes past the 256-byte buffer.
Add a !kfifo is empty() condition to the while loop so kfifo skip()
is never called on an empty fifo, and check the return value of
kfifo in() to reject reports that are too large for the fifo.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux