CVE-2026-68087 Overview
CVE-2026-68087 is a Linux kernel vulnerability in the HID Wacom driver. The flaw exists in the wacom_wac_queue_flush() function, which incorrectly uses GFP_KERNEL memory allocation flags while executing in atomic context. The function is invoked via the .raw_event callback chain (wacom_raw_event → wacom_wac_pen_serial_enforce → wacom_wac_queue_flush), which runs inside the USB HID URB completion handler hid_irq_in(). Sleeping allocations in this atomic path trigger a "scheduling while atomic" kernel bug. Upstream maintainers resolved the issue by switching to GFP_ATOMIC allocations. The existing code already handles allocation failure by skipping the fifo entry and continuing.
Critical Impact
Sleeping in atomic context can produce kernel warnings, potential system instability, and denial of service on systems using Wacom USB HID input devices.
Affected Products
- Linux kernel versions containing the affected HID Wacom driver code path
- Systems using Wacom USB HID input devices (pen tablets, digitizers)
- Stable kernel branches referenced in the upstream fix commits
Discovery Timeline
- 2026-08-10 - CVE-2026-68087 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68087
Vulnerability Analysis
The vulnerability is a kernel programming defect classified as an atomic context violation. The Linux HID subsystem invokes registered driver callbacks from interrupt handling paths that must not sleep. In the Wacom driver, wacom_wac_queue_flush() allocates memory using GFP_KERNEL, a flag that permits the allocator to block and reschedule while awaiting free pages.
Because the caller chain originates in hid_irq_in(), a URB completion handler, the CPU is in atomic context with preemption and sleeping disabled. Any blocking operation in this state triggers the kernel's scheduling while atomic check, producing a kernel warning or oops depending on configuration. Repeated triggering can destabilize the affected system.
The fix replaces GFP_KERNEL with GFP_ATOMIC, instructing the allocator to use emergency reserves without sleeping. The pre-existing fallback logic gracefully skips fifo entries when an allocation fails, so behavior degrades cleanly under memory pressure.
Root Cause
The root cause is incorrect memory allocation flag selection in a driver callback executing under atomic constraints. The function assumed process context but was reachable from interrupt-completion handlers through the .raw_event callback path.
Attack Vector
This is not a directly exploitable memory corruption issue. Triggering the code path requires attached Wacom USB HID hardware generating raw events. The impact is primarily reliability and availability rather than confidentiality or integrity. See the upstream commit 27c4dad1, commit 55f1ad57, and commit bbe1e556 for the exact patch content.
Detection Methods for CVE-2026-68087
Indicators of Compromise
- Kernel log entries containing BUG: scheduling while atomic referencing wacom_wac_queue_flush or wacom_wac_pen_serial_enforce in the stack trace
- Kernel warnings or oops messages generated during Wacom device event handling
- Unexplained input-subsystem instability on hosts with Wacom pen tablets attached
Detection Strategies
- Audit installed kernel versions against the fixed stable branches referenced in the upstream commits
- Monitor dmesg and journalctl -k output for atomic-context scheduling warnings tied to HID drivers
- Correlate kernel warnings with USB device attach events for Wacom vendor IDs
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and alert on scheduling while atomic strings
- Track kernel package versions across the fleet and flag hosts running unpatched HID Wacom driver builds
- Include Wacom-equipped workstations in reliability monitoring, watching for repeated input-subsystem faults
How to Mitigate CVE-2026-68087
Immediate Actions Required
- Update to a Linux kernel version that includes the fix from the referenced upstream stable commits
- Deploy vendor kernel updates from your Linux distribution once the patch is backported
- Inventory hosts with Wacom USB HID devices attached and prioritize them for patching
Patch Information
The upstream fix changes the memory allocation flag in wacom_wac_queue_flush() from GFP_KERNEL to GFP_ATOMIC. Patches are available in stable kernel commits 27c4dad1b7917b747bf080792a527997e3147c69, 55f1ad573e34abf9a0443c34bc5a63d74edba7d7, and bbe1e55629bfaabd4b2e8125b48dd3503d74ac8b. Apply the corresponding distribution kernel update when available.
Workarounds
- Physically disconnect Wacom USB HID devices from affected hosts until the kernel is patched
- Blacklist the wacom kernel module on systems that do not require Wacom device support
- Restrict local USB device attachment via udev rules or endpoint policy on affected workstations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
