CVE-2026-64366 HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
A slab-out-of-bounds write in the Linux kernel's Wacom HID driver allows attackers to corrupt memory, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64366?
CVE-2026-64366 is a high-severity memory corruption vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
wacom_wac_queue_insert() calls kfifo_skip() in a loop when the kfifo doesn't have enough space for the incoming report. If the kfifo is empty, kfifo_skip() reads stale data left in the kmalloc'd buffer via __kfifo_peek_n() and interprets it as a record length, advancing fifo->out by that garbage value. This corrupts the internal kfifo state, causing kfifo_unused() to return a value much larger than the actual buffer size, which bypasses __kfifo_in_r()'s guard:
if (len + recsize > kfifo_unused(fifo)) return 0;
kfifo_copy_in() then performs an out-of-bounds memcpy, writing up to 3842 bytes past the 256-byte buffer.
Add a !kfifo_is_empty() condition to the while loop so kfifo_skip() is never called on an empty fifo, and check the return value of kfifo_in() to reject reports that are too large for the fifo.
Weakness: CWE-787
Which versions are affected by CVE-2026-64366?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64366?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64366 being exploited?
There is no known exploitation of CVE-2026-64366 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64366, DEBIAN-CVE-2026-64366, GHSA-4hx3-px5f-mcx4, ROOT-OS-UBUNTU-2204-CVE-2026-64366, UBUNTU-CVE-2026-64366.