CVE-2026-63916 HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
A local attacker with access to a Wacom HID device can trigger an out-of-bounds write in the Linux kernel, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63916?
CVE-2026-63916 is a high-severity memory corruption vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
wacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE usage is always located in the first field (field[0]) of the feature report. However, a device can specify HID_DG_INPUTMODE in a different field.
If HID_DG_INPUTMODE is in a field other than the first one and the first field has a report_count smaller than the usage_index of HID_DG_INPUTMODE, this leads to an out-of-bounds write to r->field[0]->value.
Fix this by storing the field index of HID_DG_INPUTMODE in 'struct hid_data' during feature mapping. In wacom_hid_set_device_mode(), use this stored field index to access the correct field and add bounds checks to ensure both the field index and the value index are within valid ranges before writing.
Weakness: CWE-787
Which versions are affected by CVE-2026-63916?
How do I fix CVE-2026-63916?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-63916 being exploited?
There is no known exploitation of CVE-2026-63916 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-63916, DEBIAN-CVE-2026-63916, GHSA-r9m8-7m9v-6473, ROOT-OS-UBUNTU-2204-CVE-2026-63916, UBUNTU-CVE-2026-63916.