CVE-2026-98499 Overview
CVE-2026-98499 is an out-of-bounds read vulnerability in the Linux kernel's HID Wacom driver. The flaw resides in the wacom_wac_pen_serial_enforce() function, which may compute an invalid offset passed to hid_field_extract(). When a HID descriptor declares more usages than its Report Count reserves space for, the inner loop walks past the end of the field. A crafted descriptor with 12288 usages against a Report Count of 1 can read bit offset 98296, roughly 12 KB past a 2-byte received report. The extracted value is stored in wacom_wac->serial[0] and reaches userspace as an MSC_SERIAL event, producing an information disclosure.
Critical Impact
A malicious or malformed USB HID device can leak adjacent kernel memory contents to userspace through the Wacom pen serial reporting path.
Affected Products
- Linux kernel HID subsystem (drivers/hid/wacom_wac.c)
- Linux kernel version v6.12.105 (confirmed reproducer)
- Multiple stable branches patched via the referenced commits
Discovery Timeline
- 2026-10-18 - CVE-2026-98499 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98499
Vulnerability Analysis
The vulnerability is an out-of-bounds read in the Wacom HID driver's pen serial enforcement routine. The driver iterates over report->field[i]->maxusage entries and calls hid_field_extract() with an offset derived from the loop index j multiplied by the field size. The code does not validate that maxusage fits within the memory allocated for the report, which is governed by report_count.
When a HID descriptor declares more usages than report slots, the loop advances past the valid field data. The extraction function then reads memory beyond the received report buffer. The leaked bytes are written to wacom_wac->serial[0] and emitted to userspace as an MSC_SERIAL input event, exposing arbitrary kernel memory contents to any process able to read Wacom tablet events.
Root Cause
The loop bound uses maxusage instead of report_count. According to HID 1.11 section 6.2.2.8, value slots past the last declared usage reuse the final usage, so the correct iteration bound is the physical slot count. The missing bound check allows attacker-controlled descriptor metadata to drive out-of-bounds memory access.
Attack Vector
An attacker supplies a malicious HID device, either physical USB hardware or a UHID userspace device, with a descriptor advertising a Wacom pen interface. The descriptor lists an inflated usage count relative to the report size. When the driver processes an incoming report, it reads memory beyond the report buffer and surfaces those bytes through standard input event interfaces. The flaw was verified on kernel v6.12.105 using a UHID reproducer, with KASAN flagging the invalid access prior to the patch.
Detection Methods for CVE-2026-98499
Indicators of Compromise
- Unexpected UHID device creation by non-privileged or unusual processes
- Anomalous MSC_SERIAL input events emitted from devices that are not legitimate Wacom tablets
- KASAN or kernel log warnings referencing wacom_wac_pen_serial_enforce or hid_field_extract
Detection Strategies
- Audit kernel ring buffer entries (dmesg) for out-of-bounds read reports in the HID Wacom path
- Monitor /dev/uhid access and process ancestry to identify unauthorized synthetic HID device creation
- Correlate USB device insertion events with HID descriptor parsing anomalies on endpoints with Wacom driver support compiled in
Monitoring Recommendations
- Enable KASAN on test and canary systems to catch out-of-bounds reads during HID device enumeration
- Log and alert on loading of the wacom kernel module on hosts where Wacom hardware is not expected
- Track input event streams for MSC_SERIAL values emitted by newly connected or ephemeral devices
How to Mitigate CVE-2026-98499
Immediate Actions Required
- Apply the upstream kernel patch that clamps the loop to field->report_count in wacom_wac_pen_serial_enforce()
- Update to a stable kernel release containing one of the referenced fix commits
- Restrict /dev/uhid access to trusted users and services to limit synthetic HID device creation
Patch Information
The fix clamps the loop in wacom_wac_pen_serial_enforce() to field->report_count, ensuring iteration stays within the memory the report actually reserves. The patch has been backported across stable branches via commits 26471d95, 456afe47, 4b09b7c8, 65e7c4b5, 9aa237cf, 9aa62f96, c3129e6f, and eaa7d293.
Workarounds
- Blacklist the wacom kernel module on systems that do not require Wacom tablet support
- Enforce USB device policy to block unknown HID devices on sensitive endpoints
- Remove or restrict access to /dev/uhid where userspace HID device emulation is not needed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
