CVE-2026-64366

CVE CVE-2026-64366EUVD EUVD-2026-48910Published 2026-07-25T08:50:20.000ZLast changed 2026-08-05T12:41:07.000ZCVSS 8.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert wacom_wac_queue_insert() calls kfifo_skip() in a loop when the kfifo doesn't have enough space for the incoming report. If the kfifo is empty, kfifo_skip() reads stale data left in the kmalloc'd buffer via __kfifo_peek_n() and interprets it as a record length, advancing fifo->out by that garbage value. This corrupts the internal kfifo state, causing kfifo_unused() to return a value much larger than the actual buffer size, which bypasses __kfifo_in_r()'s guard: if (len + recsize > kfifo_unused(fifo)) return 0; kfifo_copy_in() then performs an out-of-bounds memcpy, writing up to 3842 bytes past the 256-byte buffer. Add a !kfifo_is_empty() condition to the while loop so kfifo_skip() is never called on an empty fifo, and check the return value of kfifo_in() to reject reports that are too large for the fifo.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 5e013ad206895e72d7da41bc1ae89d8cb499c3aa <6b3014ec0e9a390ca563030b2d7689921f0daef5; 5e013ad206895e72d7da41bc1ae89d8cb499c3aa <ca899a926c11a59211b764b0155d9a1cdcc32b81; patch: 6.18.39; patch: 7.1.4; 6.15; 5e013ad206895e72d7da41bc1ae89d8cb499c3aa <57bdd10ad50d68341f500a7b330f0d8949e510ec; patch: 7.2-rc1; patch: 0

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.