CVE-2026-64366: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64366 Overview

CVE-2026-64366 is a slab-out-of-bounds write vulnerability in the Linux kernel's HID Wacom driver. The flaw resides in the wacom_wac_queue_insert() function, which manages an internal kfifo buffer used to queue incoming HID reports from Wacom tablet devices. When the kfifo lacks space for an incoming report, the function calls kfifo_skip() in a loop without verifying that the kfifo contains data. On an empty kfifo, kfifo_skip() reads stale bytes from the underlying kmalloc'd buffer and treats them as a record length, corrupting internal state and enabling a memcpy of up to 3842 bytes past a 256-byte buffer.

Critical Impact
An attacker on an adjacent network with a malicious or spoofed Wacom HID device can trigger heap corruption in the Linux kernel, leading to potential privilege escalation, kernel memory disclosure, or denial of service.

Affected Products

Linux kernel versions containing the vulnerable wacom_wac_queue_insert() implementation in the drivers/hid/wacom_wac.c HID driver
Systems with the Wacom HID driver (hid-wacom) loaded and a Wacom-class HID device attached via USB or Bluetooth
Distributions shipping affected mainline and stable kernel branches prior to the fix commits 57bdd10, 6b3014e, and ca899a9

Discovery Timeline

2026-07-25 - CVE-2026-64366 published to the National Vulnerability Database
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64366

Vulnerability Analysis

The defect exists in the wacom_wac_queue_insert() routine in the Linux kernel HID Wacom driver. The function is responsible for enqueueing incoming HID reports into a fixed-size kfifo when the driver cannot process them immediately. When an incoming report is larger than the remaining space in the kfifo, the function attempts to make room by calling kfifo_skip() in a while loop until enough space is available.

The loop does not check whether the kfifo is empty. When kfifo_skip() runs against an empty kfifo, __kfifo_peek_n() reads uninitialized data from the kmalloc'd backing buffer and interprets it as the length of the next record. The kfifo's out pointer is then advanced by that arbitrary value, desynchronizing the ring buffer indices.

Once the internal state is corrupted, kfifo_unused() returns an inflated value that no longer reflects the true free space. The guard inside __kfifo_in_r() compares the incoming length against this inflated value and permits the write to proceed. kfifo_copy_in() then performs a memcpy() that can write up to 3842 bytes past the end of the 256-byte buffer, producing a slab-out-of-bounds write.

Root Cause

The root cause is missing precondition validation in a queue-management loop. The code assumes the kfifo contains at least one record whenever kfifo_skip() is invoked, but this invariant is not enforced. Reading a record length from uninitialized heap memory produces a garbage size that propagates through kfifo accounting and defeats the boundary check in __kfifo_in_r(). This is an Out-of-Bounds Write triggered by Uninitialized Memory Use.

Attack Vector

Exploitation requires an attacker-controlled or malicious HID device visible to the host over an adjacent network transport such as Bluetooth, or a locally attached USB device presenting Wacom HID descriptors. By sending crafted report streams that overflow the kfifo while the queue is drained to an empty state, the attacker triggers the flawed kfifo_skip() path. The resulting heap corruption can be shaped to overwrite adjacent slab objects, enabling privilege escalation, kernel information disclosure, or system crash.

No public proof-of-concept exploit code is available at this time. Technical details are documented in the upstream kernel commits referenced by the NVD entry.

Detection Methods for CVE-2026-64366

Indicators of Compromise

Kernel log entries containing KASAN reports referencing wacom_wac_queue_insert, kfifo_copy_in, __kfifo_in_r, or slab-out-of-bounds write signatures
Unexpected kernel panics, oopses, or GPF traps in systems with Wacom HID devices attached over USB or Bluetooth
Unusual Bluetooth HID pairing activity from unrecognized devices advertising Wacom vendor and product identifiers

Detection Strategies

Deploy KASAN-enabled kernels in test and pre-production environments to surface out-of-bounds writes originating from the Wacom driver
Correlate dmesg and journald kernel logs for stack traces referencing the hid-wacom module and forward them to a central log store
Monitor loaded kernel modules on endpoints and flag hosts running vulnerable kernel versions with hid-wacom present

Monitoring Recommendations

Ingest kernel and audit logs into a centralized SIEM or data lake and alert on KASAN or slab-out-of-bounds signatures tied to HID drivers
Track USB and Bluetooth device attachment events via udev and Linux audit rules to identify unauthorized HID devices connecting to sensitive hosts
Establish baseline kernel versions across the fleet and generate drift alerts when hosts remain unpatched after the fix is available

How to Mitigate CVE-2026-64366

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 57bdd10, 6b3014e, and ca899a9 as soon as distribution-provided updates are published
Prioritize patching for workstations, laptops, and creative-workflow endpoints where Wacom tablets are commonly used
Restrict physical and Bluetooth access to systems that cannot be immediately patched

Patch Information

The fix adds a !kfifo_is_empty() condition to the while loop so kfifo_skip() is never called on an empty kfifo, and it validates the return value of kfifo_in() to reject reports too large for the fifo. Distribution vendors are expected to backport the change into supported stable kernel branches. Consult your Linux vendor's security tracker for the specific package version containing the fix.

Workarounds

Unload the hid-wacom driver on systems that do not require Wacom device support using rmmod hid-wacom and blocklist the module via /etc/modprobe.d/
Disable Bluetooth HID acceptance on servers and shared workstations where wireless input devices are not required
Enforce USB device allowlisting through USBGuard or equivalent controls to prevent unauthorized HID devices from binding to the driver

bash

# Blocklist the vulnerable module until the patched kernel is installed
echo "blacklist hid-wacom" | sudo tee /etc/modprobe.d/blacklist-hid-wacom.conf
sudo rmmod hid_wacom 2>/dev/null || true
sudo update-initramfs -u