CVE-2026-89999 (GCVE-0-2026-89999)
Vulnerability from cvelistv5
Published
2026-09-16 10:33
Modified
2026-10-19 08:56
Severity ?
8.1 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacom_intuos_pro2_bt_irq wacom_intuos_pro2_bt_irq() receives the wire report length in `len` but never consults it before parsing. After the report-id gate it unconditionally calls wacom_intuos_pro2_bt_pen() and then, selected by features.type, a fixed chain of sub-parsers, none of which receive `len`: wacom_intuos_pro2_bt_pen(wacom); if (type == INTUOSP2_BT || type == INTUOSP2S_BT) { wacom_intuos_pro2_bt_touch(wacom); wacom_intuos_pro2_bt_pad(wacom); wacom_intuos_pro2_bt_battery(wacom); } else { wacom_intuos_gen3_bt_pad(wacom); wacom_intuos_gen3_bt_battery(wacom); } Each sub-parser dereferences wacom->data at fixed offsets. The furthest byte touched on each branch is: INTUOSP2_BT / INTUOSP2S_BT: wacom_intuos_pro2_bt_pad() reads data[285] (the touchring byte), so the report must be at least 286 bytes; INTUOSHT3_BT ("gen3"): wacom_intuos_gen3_bt_battery() reads data[45], so the report must be at least 46 bytes. features.type is selected from the VID/PID id_table entry and wacom_setup_device_quirks() force-registers the pen/pad/touch inputs for that type independent of the report descriptor, so a malicious or malfunctioning paired/spoofed Bluetooth peripheral can advertise that VID/PID and send an undersized report that still satisfies the data[0] == 0x80/0x81 gate. The driver then reads past the received report and forwards the bytes to userspace via evdev (MSC_SERIAL / ABS_MISC / ABS_WHEEL on the pen and pad input nodes), an out-of-bounds read with a concrete userspace read-back channel, and a true out-of-bounds read on transports whose backing buffer is sized to the (small) report descriptor rather than a fixed-size staging buffer. This is the same class of bug commit 2f1763f62909 ("HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq") already hardened in the sibling wacom_intuos_bt_irq(), which guards each report id against its minimum length before parsing. Guard wacom_intuos_pro2_bt_irq() the same way: before parsing, reject reports shorter than the furthest offset the selected branch actually dereferences, warn, and bail out. Because the whole pen/touch/pad/ battery chain runs unconditionally per branch, a single up-front check against the maximum offset (286 bytes for INTUOSP2_BT/INTUOSP2S_BT, 46 bytes for the gen3 branch) bounds every sub-parser. Returning 0 on a short report also skips those calls for the same malformed report, which is the safe, conservative behavior.
References
Impacted products
Vendor Product Version
Linux Linux Version: 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b
Version: 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b
Version: 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b
Version: 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b
Version: 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b
Version: 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b
Version: 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b
Version: 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/wacom_wac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d2844f3fcd058113acbe0aa110ab13ef28b98d9f",
              "status": "affected",
              "version": "4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b",
              "versionType": "git"
            },
            {
              "lessThan": "1bfc0547b81d5861443420d19b5ed2fd533cd17f",
              "status": "affected",
              "version": "4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b",
              "versionType": "git"
            },
            {
              "lessThan": "84781a1f3c5dc6650480be9329e6e8528939eaa0",
              "status": "affected",
              "version": "4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b",
              "versionType": "git"
            },
            {
              "lessThan": "96dd0af7597aba2d80cc97e2f66e8b72d30ba125",
              "status": "affected",
              "version": "4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b",
              "versionType": "git"
            },
            {
              "lessThan": "114af803e409a68e52516810ecd24df4d8ce0c68",
              "status": "affected",
              "version": "4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b",
              "versionType": "git"
            },
            {
              "lessThan": "74ec08f7b81c2726578039ca6dea0fec136c38ea",
              "status": "affected",
              "version": "4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b",
              "versionType": "git"
            },
            {
              "lessThan": "0cdc6cb242dd8d2731956fdf3390de094482a4b2",
              "status": "affected",
              "version": "4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b",
              "versionType": "git"
            },
            {
              "lessThan": "a8e04f3f894ccb52cfcd7e60125a9f35da4a616d",
              "status": "affected",
              "version": "4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/wacom_wac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: validate report length in wacom_intuos_pro2_bt_irq\n\nwacom_intuos_pro2_bt_irq() receives the wire report length in `len`\nbut never consults it before parsing. After the report-id gate it\nunconditionally calls wacom_intuos_pro2_bt_pen() and then, selected by\nfeatures.type, a fixed chain of sub-parsers, none of which receive\n`len`:\n\n\twacom_intuos_pro2_bt_pen(wacom);\n\tif (type == INTUOSP2_BT || type == INTUOSP2S_BT) {\n\t\twacom_intuos_pro2_bt_touch(wacom);\n\t\twacom_intuos_pro2_bt_pad(wacom);\n\t\twacom_intuos_pro2_bt_battery(wacom);\n\t} else {\n\t\twacom_intuos_gen3_bt_pad(wacom);\n\t\twacom_intuos_gen3_bt_battery(wacom);\n\t}\n\nEach sub-parser dereferences wacom-\u003edata at fixed offsets. The furthest\nbyte touched on each branch is:\n\n  INTUOSP2_BT / INTUOSP2S_BT: wacom_intuos_pro2_bt_pad() reads data[285]\n\t(the touchring byte), so the report must be at least 286 bytes;\n  INTUOSHT3_BT (\"gen3\"): wacom_intuos_gen3_bt_battery() reads data[45],\n\tso the report must be at least 46 bytes.\n\nfeatures.type is selected from the VID/PID id_table entry and\nwacom_setup_device_quirks() force-registers the pen/pad/touch inputs\nfor that type independent of the report descriptor, so a malicious or\nmalfunctioning paired/spoofed Bluetooth peripheral can advertise that\nVID/PID and send an undersized report that still satisfies the\ndata[0] == 0x80/0x81 gate. The driver then reads past the received\nreport and forwards the bytes to userspace via evdev (MSC_SERIAL /\nABS_MISC / ABS_WHEEL on the pen and pad input nodes), an out-of-bounds\nread with a concrete userspace read-back channel, and a true\nout-of-bounds read on transports whose backing buffer is sized to the\n(small) report descriptor rather than a fixed-size staging buffer.\n\nThis is the same class of bug commit 2f1763f62909 (\"HID: wacom: fix\nout-of-bounds read in wacom_intuos_bt_irq\") already hardened in the\nsibling wacom_intuos_bt_irq(), which guards each report id against its\nminimum length before parsing.\n\nGuard wacom_intuos_pro2_bt_irq() the same way: before parsing, reject\nreports shorter than the furthest offset the selected branch actually\ndereferences, warn, and bail out. Because the whole pen/touch/pad/\nbattery chain runs unconditionally per branch, a single up-front check\nagainst the maximum offset (286 bytes for INTUOSP2_BT/INTUOSP2S_BT,\n46 bytes for the gen3 branch) bounds every sub-parser. Returning 0 on\na short report also skips those calls for the same malformed report,\nwhich is the safe, conservative behavior."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - wacom_intuos_pro2_bt_irq() is reached only for BUS_BLUETOOTH Wacom Intuos Pro/HT3 devices (VID 0x056a, PIDs 0x360/0x361/0x377/0x379/0x393/0x3c6/0x3c8/0x3dd) via hidp/uhid HID input reports over L2CAP, so the attacker must be a Bluetooth HID peer on the same radio segment.\nAC:L - The attacker fully controls the HID report ID, descriptor, and wire length; any report with data[0]==0x80/0x81 that hid_get_report() accepts is parsed at fixed offsets with no length check, so a short report reliably triggers the OOB read.\nPR:N - The attacker is the Bluetooth HID peripheral sending input reports and needs no local account or capability; BlueZ/hidp connection setup is a host-side management path, not a privilege required of the reporting device.\nUI:N - After a paired, spoofed, or already-connected Intuos Pro/HT3 Bluetooth HID session exists, the peer can emit the short 0x80/0x81 report on the interrupt channel without further victim clicks, pairing prompts, or mounts.\nS:U - The Wacom HID parser and the resulting kernel/input/power_supply impact remain under the same host kernel security authority, with no VM escape, IOMMU/DMA bypass, or other cross-boundary effect.\nC:H - The parsers read wacom-\u003edata at fixed offsets through data[285] (286 bytes) ignoring len, which is a kernel OOB read, and those bytes are reported to userspace via evdev (MSC_SERIAL, ABS_MISC, ABS_WHEEL, pen/touch axes), a concrete disclosure channel.\nI:N - The defect is an out-of-bounds read of the HID report buffer, not an OOB write or UAF, and it does not yield an attacker-controlled kernel memory modification or control-flow hijack primitive.\nA:H - Reading hundreds of bytes past a short HID report can fault when the transport buffer is sized to the received report or descriptor rather than a large staging buffer, and an adjacent peer can repeat the malformed report to panic or oops the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:56:13.267Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d2844f3fcd058113acbe0aa110ab13ef28b98d9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bfc0547b81d5861443420d19b5ed2fd533cd17f"
        },
        {
          "url": "https://git.kernel.org/stable/c/84781a1f3c5dc6650480be9329e6e8528939eaa0"
        },
        {
          "url": "https://git.kernel.org/stable/c/96dd0af7597aba2d80cc97e2f66e8b72d30ba125"
        },
        {
          "url": "https://git.kernel.org/stable/c/114af803e409a68e52516810ecd24df4d8ce0c68"
        },
        {
          "url": "https://git.kernel.org/stable/c/74ec08f7b81c2726578039ca6dea0fec136c38ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/0cdc6cb242dd8d2731956fdf3390de094482a4b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8e04f3f894ccb52cfcd7e60125a9f35da4a616d"
        }
      ],
      "title": "HID: wacom: validate report length in wacom_intuos_pro2_bt_irq",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89999",
    "datePublished": "2026-09-16T10:33:10.683Z",
    "dateReserved": "2026-09-11T19:38:34.780Z",
    "dateUpdated": "2026-10-19T08:56:13.267Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.