CVE-2026-64366 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
wacom_wac_queue_insert() calls kfifo_skip() in a loop when the kfifo doesn't have enough space for the incoming report. If the kfifo is empty, kfifo_skip() reads stale data left in the kmalloc'd buffer via __kfifo_peek_n() and interprets it as a record length, advancing fifo->out by that garbage value. This corrupts the internal kfifo state, causing kfifo_unused() to return a value much larger than the actual buffer size, which bypasses __kfifo_in_r()'s guard:
if (len + recsize > kfifo_unused(fifo)) return 0;
kfifo_copy_in() then performs an out-of-bounds memcpy, writing up to 3842 bytes past the 256-byte buffer.
Add a !kfifo_is_empty() condition to the while loop so kfifo_skip() is never called on an empty fifo, and check the return value of kfifo_in() to reject reports that are too large for the fifo.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability identified in the Linux kernel's HID wacom driver represents a critical slab out-of-bounds write condition that arises from improper handling of kernel FIFO (kfifo) operations within the wacom_wac_queue_insert function. This flaw occurs when processing incoming HID reports from Wacom tablet devices and demonstrates a classic buffer overflow pattern where stale data is misinterpreted as valid metadata. The issue stems from the kfifo_skip() function being invoked on an empty FIFO, which causes the system to read garbage data from the underlying kmalloc'd buffer through __kfifo_peek_n() and treat this corrupted data as a record length value.
The technical execution of this vulnerability begins with the wacom_wac_queue_insert() function entering a loop that calls kfifo_skip() when the kfifo cannot accommodate the incoming report. When the FIFO is empty, kfifo_skip() accesses the kmalloc'd buffer space where stale data remains from previous operations, and this garbage data gets interpreted as a legitimate record length. This misinterpretation causes the fifo->out pointer to be advanced by an incorrect value, fundamentally corrupting the internal FIFO state management. The corruption manifests in the kfifo_unused() function returning an inflated value that far exceeds the actual buffer capacity, effectively bypassing a crucial guard mechanism in __kfifo_in_r().
The bypass of the safety check creates a dangerous condition where the system performs an out-of-bounds memory copy operation through kfifo_copy_in(). Specifically, this operation writes up to 3842 bytes beyond the intended 256-byte buffer limit, resulting in a severe memory corruption that can lead to arbitrary code execution or system instability. This vulnerability directly maps to CWE-129 Input Validation and CWE-787 Out-of-bounds Write, representing a combination of improper input validation and buffer overflow conditions. The attack surface is particularly concerning as it affects the kernel's HID subsystem and specifically targets device drivers that process input reports from peripheral devices.
The mitigation strategy implemented addresses the root cause by adding a !kfifo_is_empty() condition to the while loop structure, ensuring that kfifo_skip() is never executed on an empty FIFO. This prevents the reading of stale data that leads to the corruption of internal FIFO state. Additionally, the fix incorporates checking the return value of kfifo_in() to explicitly reject reports that exceed the FIFO's capacity, providing additional validation layers. This remediation aligns with ATT&CK technique T1068, which covers 'Exploitation for Privilege Escalation' and 'Exploitation of Remote Services', as it prevents an attacker from leveraging kernel memory corruption vulnerabilities to gain elevated privileges through device driver exploitation.
The fix demonstrates proper defensive programming practices that should be applied across all kernel FIFO implementations where data integrity is paramount. The vulnerability highlights the importance of validating queue state before performing operations that could lead to memory corruption, particularly in kernel drivers handling real-time input data streams. This specific issue underscores the need for comprehensive testing of edge cases involving empty buffer conditions and proper bounds checking in kernel subsystems that manage data queues and buffers. The resolution maintains system stability while ensuring that legitimate device input processing continues unaffected, preventing both denial-of-service scenarios and potential privilege escalation attacks that could arise from such memory corruption vulnerabilities.