CVE-2026-89999

HID: wacom: validate report length in wacom_intuos_pro2_bt_irq

Published Sep 16, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: validate report length in wacom_intuos_pro2_bt_irq

wacom_intuos_pro2_bt_irq() receives the wire report length in `len`
but never consults it before parsing. After the report-id gate it
unconditionally calls wacom_intuos_pro2_bt_pen() and then, selected by
features.type, a fixed chain of sub-parsers, none of which receive
`len`:

wacom_intuos_pro2_bt_pen(wacom);
if (type == INTUOSP2_BT || type == INTUOSP2S_BT) {
wacom_intuos_pro2_bt_touch(wacom);
wacom_intuos_pro2_bt_pad(wacom);
wacom_intuos_pro2_bt_battery(wacom);
} else {
wacom_intuos_gen3_bt_pad(wacom);
wacom_intuos_gen3_bt_battery(wacom);
}

Each sub-parser dereferences wacom->data at fixed offsets. The furthest
byte touched on each branch is:

INTUOSP2_BT / INTUOSP2S_BT: wacom_intuos_pro2_bt_pad() reads data[285]
(the touchring byte), so the report must be at least 286 bytes;
INTUOSHT3_BT ("gen3"): wacom_intuos_gen3_bt_battery() reads data[45],
so the report must be at least 46 bytes.

features.type is selected from the VID/PID id_table entry and
wacom_setup_device_quirks() force-registers the pen/pad/touch inputs
for that type independent of the report descriptor, so a malicious or
malfunctioning paired/spoofed Bluetooth peripheral can advertise that
VID/PID and send an undersized report that still satisfies the
data[0] == 0x80/0x81 gate. The driver then reads past the received
report and forwards the bytes to userspace via evdev (MSC_SERIAL /
ABS_MISC / ABS_WHEEL on the pen and pad input nodes), an out-of-bounds
read with a concrete userspace read-back channel, and a true
out-of-bounds read on transports whose backing buffer is sized to the
(small) report descriptor rather than a fixed-size staging buffer.

This is the same class of bug commit 2f1763f62909 ("HID: wacom: fix
out-of-bounds read in wacom_intuos_bt_irq") already hardened in the
sibling wacom_intuos_bt_irq(), which guards each report id against its
minimum length before parsing.

Guard wacom_intuos_pro2_bt_irq() the same way: before parsing, reject
reports shorter than the furthest offset the selected branch actually
dereferences, warn, and bail out. Because the whole pen/touch/pad/
battery chain runs unconditionally per branch, a single up-front check
against the maximum offset (286 bytes for INTUOSP2_BT/INTUOSP2S_BT,
46 bytes for the gen3 branch) bounds every sub-parser. Returning 0 on
a short report also skips those calls for the same malformed report,
which is the safe, conservative behavior.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b`	affected	< d2844f3fcd058113acbe0aa110ab13ef28b98d9f
`4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b`	affected	< 1bfc0547b81d5861443420d19b5ed2fd533cd17f
`4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b`	affected	< 84781a1f3c5dc6650480be9329e6e8528939eaa0
`4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b`	affected	< 96dd0af7597aba2d80cc97e2f66e8b72d30ba125
`4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b`	affected	< 114af803e409a68e52516810ecd24df4d8ce0c68
`4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b`	affected	< 74ec08f7b81c2726578039ca6dea0fec136c38ea
`4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b`	affected	< 0cdc6cb242dd8d2731956fdf3390de094482a4b2
`4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b`	affected	< a8e04f3f894ccb52cfcd7e60125a9f35da4a616d

Linux

affected

Version	Status	Constraints
`4.11`	affected	—
`0`	unaffected	< 4.11
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b,d2844f3fcd058113acbe0aa110ab13ef28b98d9f)`	affected	code_commit	—
`[4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b,1bfc0547b81d5861443420d19b5ed2fd533cd17f)`	affected	code_commit	—
`[4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b,84781a1f3c5dc6650480be9329e6e8528939eaa0)`	affected	code_commit	—
`[4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b,96dd0af7597aba2d80cc97e2f66e8b72d30ba125)`	affected	code_commit	—
`[4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b,114af803e409a68e52516810ecd24df4d8ce0c68)`	affected	code_commit	—
`[4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b,74ec08f7b81c2726578039ca6dea0fec136c38ea)`	affected	code_commit	—
`[4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b,0cdc6cb242dd8d2731956fdf3390de094482a4b2)`	affected	code_commit	—
`[4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b,a8e04f3f894ccb52cfcd7e60125a9f35da4a616d)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.11`	affected	semver	—
`[0,4.11)`	unaffected	semver	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.5,7.3.0)`	unaffected	semver	—
`[7.3-rc2,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.370% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0cdc6cb242dd8d2731956fdf3390de094482a4b2
https://git.kernel.org/stable/c/114af803e409a68e52516810ecd24df4d8ce0c68
https://git.kernel.org/stable/c/1bfc0547b81d5861443420d19b5ed2fd533cd17f
https://git.kernel.org/stable/c/74ec08f7b81c2726578039ca6dea0fec136c38ea
https://git.kernel.org/stable/c/84781a1f3c5dc6650480be9329e6e8528939eaa0
https://git.kernel.org/stable/c/96dd0af7597aba2d80cc97e2f66e8b72d30ba125
https://git.kernel.org/stable/c/a8e04f3f894ccb52cfcd7e60125a9f35da4a616d
https://git.kernel.org/stable/c/d2844f3fcd058113acbe0aa110ab13ef28b98d9f

History

Sep 18, 2026 5:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125 CWE-20

Sep 16, 2026 2:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}`

Sep 16, 2026 10:45 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacom_intuos_pro2_bt_irq wacom_intuos_pro2_bt_irq() receives the wire report length in `len` but never consults it before parsing. After the report-id gate it unconditionally calls wacom_intuos_pro2_bt_pen() and then, selected by features.type, a fixed chain of sub-parsers, none of which receive `len`: wacom_intuos_pro2_bt_pen(wacom); if (type == INTUOSP2_BT \|\| type == INTUOSP2S_BT) { wacom_intuos_pro2_bt_touch(wacom); wacom_intuos_pro2_bt_pad(wacom); wacom_intuos_pro2_bt_battery(wacom); } else { wacom_intuos_gen3_bt_pad(wacom); wacom_intuos_gen3_bt_battery(wacom); } Each sub-parser dereferences wacom->data at fixed offsets. The furthest byte touched on each branch is: INTUOSP2_BT / INTUOSP2S_BT: wacom_intuos_pro2_bt_pad() reads data[285] (the touchring byte), so the report must be at least 286 bytes; INTUOSHT3_BT ("gen3"): wacom_intuos_gen3_bt_battery() reads data[45], so the report must be at least 46 bytes. features.type is selected from the VID/PID id_table entry and wacom_setup_device_quirks() force-registers the pen/pad/touch inputs for that type independent of the report descriptor, so a malicious or malfunctioning paired/spoofed Bluetooth peripheral can advertise that VID/PID and send an undersized report that still satisfies the data[0] == 0x80/0x81 gate. The driver then reads past the received report and forwards the bytes to userspace via evdev (MSC_SERIAL / ABS_MISC / ABS_WHEEL on the pen and pad input nodes), an out-of-bounds read with a concrete userspace read-back channel, and a true out-of-bounds read on transports whose backing buffer is sized to the (small) report descriptor rather than a fixed-size staging buffer. This is the same class of bug commit 2f1763f62909 ("HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq") already hardened in the sibling wacom_intuos_bt_irq(), which guards each report id against its minimum length before parsing. Guard wacom_intuos_pro2_bt_irq() the same way: before parsing, reject reports shorter than the furthest offset the selected branch actually dereferences, warn, and bail out. Because the whole pen/touch/pad/ battery chain runs unconditionally per branch, a single up-front check against the maximum offset (286 bytes for INTUOSP2_BT/INTUOSP2S_BT, 46 bytes for the gen3 branch) bounds every sub-parser. Returning 0 on a short report also skips those calls for the same malformed report, which is the safe, conservative behavior.
Title		HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0cdc6cb242dd8d2731956fdf3390de094482a4b2 https://git.kernel.org/stable/c/114af803e409a68e52516810ecd24df4d8ce0c68 https://git.kernel.org/stable/c/1bfc0547b81d5861443420d19b5ed2fd533cd17f https://git.kernel.org/stable/c/74ec08f7b81c2726578039ca6dea0fec136c38ea https://git.kernel.org/stable/c/84781a1f3c5dc6650480be9329e6e8528939eaa0 https://git.kernel.org/stable/c/96dd0af7597aba2d80cc97e2f66e8b72d30ba125 https://git.kernel.org/stable/c/a8e04f3f894ccb52cfcd7e60125a9f35da4a616d https://git.kernel.org/stable/c/d2844f3fcd058113acbe0aa110ab13ef28b98d9f