CVE-2026-89999: Linux Kernel HID Wacom Buffer Overflow

CVE-2026-89999 Overview

CVE-2026-89999 is an out-of-bounds read vulnerability in the Linux kernel's HID Wacom driver. The flaw resides in wacom_intuos_pro2_bt_irq(), which parses Bluetooth HID reports from Wacom Intuos Pro 2 and gen3 tablets without validating the report length against the offsets its sub-parsers dereference. A paired or spoofed Bluetooth peripheral advertising a matching VID/PID can send an undersized report that passes the data[0] == 0x80/0x81 gate. The driver then reads beyond the received buffer and forwards the leaked bytes to userspace through evdev nodes (MSC_SERIAL, ABS_MISC, ABS_WHEEL).

Critical Impact
Adjacent-network attackers with a spoofed Bluetooth peripheral can trigger a kernel out-of-bounds read that exposes kernel memory to userspace via evdev and can crash affected systems.

Affected Products

Linux kernel HID Wacom driver (drivers/hid/wacom_wac.c)
Systems pairing Wacom Intuos Pro 2 (INTUOSP2_BT, INTUOSP2S_BT) tablets over Bluetooth
Systems pairing Wacom Intuos gen3 (INTUOSHT3_BT) tablets over Bluetooth

Discovery Timeline

2026-09-16 - CVE-2026-89999 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89999

Vulnerability Analysis

The wacom_intuos_pro2_bt_irq() function receives the wire report length in len but never consults it before parsing. After a single report-id check on data[0], the function unconditionally invokes wacom_intuos_pro2_bt_pen() followed by a fixed chain of sub-parsers selected by features.type. None of these sub-parsers receive len, and each dereferences wacom->data at fixed offsets.

For INTUOSP2_BT and INTUOSP2S_BT devices, wacom_intuos_pro2_bt_pad() reads data[285], requiring at least 286 bytes. For the gen3 branch, wacom_intuos_gen3_bt_battery() reads data[45], requiring at least 46 bytes. Any shorter report causes the driver to read past the buffer.

Because the driver forwards these bytes to userspace through evdev input nodes, the out-of-bounds read is not silent. An attacker gains a concrete read-back channel for whatever memory follows the undersized report buffer. On transports whose backing buffer is sized to the report descriptor rather than a fixed staging buffer, this becomes a true out-of-bounds read across allocation boundaries.

Root Cause

The root cause is missing input validation [CWE-125 class]. The parser trusts the report-id gate and the features.type value derived from the VID/PID id_table entry rather than validating the actual report length. wacom_setup_device_quirks() force-registers pen, pad, touch, and battery inputs based on device type independent of the report descriptor, so a malicious peripheral advertising the correct VID/PID reaches the vulnerable parsing path with any report size it chooses.

Attack Vector

Exploitation requires adjacent-network access via Bluetooth. An attacker pairs a spoofed peripheral advertising a supported Wacom VID/PID, or compromises a legitimate paired device. The attacker then sends a short HID report whose first byte matches 0x80 or 0x81 but whose total length is under 286 bytes (Intuos Pro 2) or 46 bytes (gen3). The driver processes the report, reads past the allocation, and emits the out-of-bounds bytes to userspace through pen and pad evdev nodes readable by any process with access to those input devices.

The vulnerability mirrors the earlier bug class fixed in wacom_intuos_bt_irq() by commit 2f1763f62909 ("HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq"). See the upstream fix commit for the applied guard.

Detection Methods for CVE-2026-89999

Indicators of Compromise

Kernel warnings originating from wacom_intuos_pro2_bt_irq() after the patch is applied, indicating short-report rejections and possible probing.
Unexpected Bluetooth pairings or HID devices advertising Wacom VID/PIDs on hosts that do not use Wacom hardware.
Anomalous evdev input events emitting MSC_SERIAL, ABS_MISC, or ABS_WHEEL values that do not correspond to physical device activity.

Detection Strategies

Inventory Linux endpoints running the vulnerable wacom_wac.c code by comparing running kernel versions against the fixed commits listed in the upstream references.
Monitor dmesg and journald for HID Wacom warnings and Bluetooth HID connection events from unknown MAC addresses.
Audit which user accounts and processes have read access to /dev/input/event* nodes tied to Wacom devices, since these are the exfiltration channel.

Monitoring Recommendations

Alert on Bluetooth pairing events involving HID class devices on servers and shared workstations where such devices are not expected.
Correlate kernel log entries for HID Wacom parsing with Bluetooth L2CAP session establishment to surface suspicious peripherals.
Track kernel package versions across the fleet and flag hosts missing the referenced stable patches.

How to Mitigate CVE-2026-89999

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry to all affected systems as soon as vendor builds are available.
Disable Bluetooth on systems that do not require it, particularly servers and kiosks where Wacom tablets are never used.
Unpair unknown or unused Bluetooth HID peripherals and restrict which users can initiate new pairings.

Patch Information

The fix adds an up-front length check in wacom_intuos_pro2_bt_irq() that rejects reports shorter than the furthest offset the selected branch dereferences (286 bytes for INTUOSP2_BT/INTUOSP2S_BT, 46 bytes for the gen3 branch), warns, and returns 0. Fix commits include 0cdc6cb, 114af80, 1bfc054, 74ec08f, 84781a1, 96dd0af, a8e04f3, and d2844f3.

Workarounds

Blacklist the wacom kernel module on systems that do not use Wacom hardware using /etc/modprobe.d/ configuration.
Disable the Bluetooth stack entirely where operationally acceptable by stopping and masking bluetooth.service.
Restrict Bluetooth discoverability and require explicit administrator approval for new HID pairings.

bash

# Blacklist the wacom module and disable Bluetooth on hosts that do not need them
echo "blacklist wacom" | sudo tee /etc/modprobe.d/blacklist-wacom.conf
sudo systemctl stop bluetooth.service
sudo systemctl mask bluetooth.service