CVE-2026-63916: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63916 Overview

CVE-2026-63916 is an out-of-bounds write vulnerability in the Linux kernel's Wacom HID driver. The flaw resides in the wacom_hid_set_device_mode() function, which incorrectly assumes the HID_DG_INPUTMODE usage is always located in the first field (field[0]) of the feature report. A malicious or malformed HID device can specify HID_DG_INPUTMODE in a different field. When the first field has a report_count smaller than the usage_index of HID_DG_INPUTMODE, the driver writes past the allocated bounds of r->field[0]->value. This corrupts kernel memory and can lead to privilege escalation or system compromise.

Critical Impact
An attacker with adjacent access via a crafted or malicious HID device can trigger kernel memory corruption, potentially resulting in local privilege escalation or denial of service.

Affected Products

Linux kernel versions containing the vulnerable wacom_hid_set_device_mode() implementation in the Wacom HID driver
Distributions shipping unpatched Wacom HID drivers on stable and long-term kernel branches
Systems that accept Wacom or compatible HID digitizer devices via USB or Bluetooth

Discovery Timeline

2026-07-19 - CVE-2026-63916 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63916

Vulnerability Analysis

The vulnerability exists in the Wacom HID driver code path invoked during device initialization. When the kernel processes a Wacom-compatible HID digitizer, wacom_hid_set_device_mode() writes to a value array indexed by usage_index to configure the device's input mode. The function accesses r->field[0]->value[usage_index] unconditionally, without validating that field 0 actually contains the HID_DG_INPUTMODE usage or that usage_index falls within report_count.

An attacker who supplies a device with a crafted HID report descriptor can place HID_DG_INPUTMODE in a later field while ensuring field[0] has a small report_count. The resulting write lands outside the allocated value array, corrupting adjacent kernel heap memory. This class of flaw is categorized as an out-of-bounds write [CWE-787] within kernel space.

Root Cause

The root cause is a missing invariant check. The driver hardcodes the assumption that HID_DG_INPUTMODE resides in field[0] of the feature report. HID report descriptors are attacker-influenced data when a hostile peripheral is attached, so this assumption is unsafe. The fix stores the field index of HID_DG_INPUTMODE in struct hid_data during feature mapping and uses it to access the correct field. The patch also adds bounds checks on both the field index and the value index before writing.

Attack Vector

Exploitation requires the attacker to attach or emulate a malicious HID device on the target system. This can be achieved through physical USB access, a compromised Bluetooth pairing, or a hostile USB-over-IP endpoint on an adjacent network. Once the device is enumerated, the crafted HID report descriptor triggers the out-of-bounds write during wacom_hid_set_device_mode() execution, corrupting kernel heap contents. Skilled attackers can shape the corruption into a privilege escalation primitive.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.345% at the 26.9 percentile.

Detection Methods for CVE-2026-63916

Indicators of Compromise

Kernel oops, panic, or KASAN: slab-out-of-bounds reports referencing wacom_hid_set_device_mode in dmesg or journalctl -k output
Unexpected Wacom or HID digitizer device enumeration events on systems that do not normally use such peripherals
Anomalous USB device insertion events immediately preceding kernel memory corruption traces

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test systems to surface out-of-bounds writes originating in the Wacom driver
Audit udev and kernel logs for HID feature report parsing anomalies tied to the wacom module
Correlate USB device attach events with subsequent kernel warnings or crashes to identify malicious peripheral activity

Monitoring Recommendations

Forward kernel ring buffer messages and USB subsystem events to a centralized log platform for cross-host correlation
Alert on new HID device vendor and product IDs appearing on servers, kiosks, and workstations that do not require digitizer input
Track loaded kernel modules and version metadata to identify hosts still running vulnerable wacom driver builds

How to Mitigate CVE-2026-63916

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits and reboot affected hosts
Inventory all systems running the wacom kernel module and prioritize patching for shared or physically accessible endpoints
Restrict physical and Bluetooth access to production servers and privileged workstations until patched

Patch Information

The fix is available across multiple stable branches through the following commits: 2add311d, 43e7c02d, 5716a293, 5db3fca0, 83bd8a57, b8338111, c0a8899e, and ed598de9. See the Kernel Git Commit 2add311d and the Kernel Git Commit ed598de9 for the patch content. The fix stores the correct field index during feature mapping and adds bounds checks before writing to the value array.

Workarounds

Blacklist the wacom kernel module on systems that do not require Wacom digitizer support using /etc/modprobe.d/
Enforce USB device filtering with usbguard to allow only known-good vendor and product IDs
Disable Bluetooth HID pairing on servers and headless systems where it is not required

bash

# Blacklist the wacom module and block unauthorized USB HID devices
echo "blacklist wacom" | sudo tee /etc/modprobe.d/blacklist-wacom.conf
sudo depmod -a
sudo update-initramfs -u

# Example usbguard policy: allow only pre-approved HID devices
sudo usbguard generate-policy > /etc/usbguard/rules.conf
sudo systemctl enable --now usbguard