CVE-2026-89999 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
wacom_intuos_pro2_bt_irq() receives the wire report length in `len` but never consults it before parsing. After the report-id gate it unconditionally calls wacom_intuos_pro2_bt_pen() and then, selected by features.type, a fixed chain of sub-parsers, none of which receive `len`:
wacom_intuos_pro2_bt_pen(wacom); if (type == INTUOSP2_BT || type == INTUOSP2S_BT) {
wacom_intuos_pro2_bt_touch(wacom); wacom_intuos_pro2_bt_pad(wacom); wacom_intuos_pro2_bt_battery(wacom); } else {
wacom_intuos_gen3_bt_pad(wacom); wacom_intuos_gen3_bt_battery(wacom); }
Each sub-parser dereferences wacom->data at fixed offsets. The furthest byte touched on each branch is:
INTUOSP2_BT / INTUOSP2S_BT: wacom_intuos_pro2_bt_pad() reads data[285]
(the touchring byte), so the report must be at least 286 bytes; INTUOSHT3_BT ("gen3"): wacom_intuos_gen3_bt_battery() reads data[45],
so the report must be at least 46 bytes.
features.type is selected from the VID/PID id_table entry and wacom_setup_device_quirks() force-registers the pen/pad/touch inputs for that type independent of the report descriptor, so a malicious or malfunctioning paired/spoofed Bluetooth peripheral can advertise that VID/PID and send an undersized report that still satisfies the data[0] == 0x80/0x81 gate. The driver then reads past the received
report and forwards the bytes to userspace via evdev (MSC_SERIAL / ABS_MISC / ABS_WHEEL on the pen and pad input nodes), an out-of-bounds read with a concrete userspace read-back channel, and a true out-of-bounds read on transports whose backing buffer is sized to the (small) report descriptor rather than a fixed-size staging buffer.
This is the same class of bug commit 2f1763f62909 ("HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq") already hardened in the sibling wacom_intuos_bt_irq(), which guards each report id against its minimum length before parsing.
Guard wacom_intuos_pro2_bt_irq() the same way: before parsing, reject reports shorter than the furthest offset the selected branch actually dereferences, warn, and bail out. Because the whole pen/touch/pad/ battery chain runs unconditionally per branch, a single up-front check against the maximum offset (286 bytes for INTUOSP2_BT/INTUOSP2S_BT, 46 bytes for the gen3 branch) bounds every sub-parser. Returning 0 on a short report also skips those calls for the same malformed report, which is the safe, conservative behavior.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel HID subsystem contains an out-of-bounds read vulnerability within the wacom_intuos_pro2_bt_irq function in the Wacom tablet driver. This flaw arises because the function receives a wire report length parameter but fails to validate it before proceeding with data parsing operations. Upon receiving input, the code performs a preliminary check on the report identifier and then unconditionally invokes a chain of sub-parsers based on the device type determined by vendor and product identifiers. These parsers access specific offsets within the wacom->data buffer without verifying that the incoming report is large enough to contain those bytes. This lack of bounds checking creates a scenario where malformed or maliciously crafted Bluetooth reports can trigger memory accesses beyond the allocated buffer boundaries, leading to potential information disclosure or system instability depending on the surrounding kernel memory layout and access patterns.
The technical severity of this vulnerability stems from the specific offsets accessed by different device branches within the driver logic. For devices identified as INTUOSP2_BT or INTUOSP2S_BT, the parsing chain includes a call that reads data at offset 285, requiring a minimum report length of 286 bytes to remain safe. Conversely, for gen3 style devices like INTUOSHT3_BT, the furthest accessed byte is at offset 45, necessitating a minimum length of 46 bytes. Because device features are registered based on static VID/PID tables rather than dynamic report descriptors, an attacker or malfunctioning peripheral can spoof these identifiers to trigger the longer parsing path while sending significantly shorter reports. This mismatch allows the driver to read arbitrary kernel memory adjacent to the input buffer and subsequently forward this uninitialized or sensitive data to userspace through standard event device interfaces such as evdev nodes for pen, touch, pad, and battery status.
From a security architecture perspective, this vulnerability aligns with CWE-125, which describes an out-of-bounds read where software reads past the end of a buffer. The attack vector is classified under ATT&CK technique T1059, specifically command scripting or input interpretation flaws that allow for unauthorized data access via HID devices. The impact extends beyond simple memory corruption; because the invalid bytes are forwarded to userspace applications listening on the corresponding input nodes, an attacker can potentially exfiltrate kernel stack contents, heap metadata, or other sensitive information residing in adjacent memory regions. This constitutes a concrete side-channel leakage path that could aid further exploitation attempts by revealing pointers or secrets necessary for bypassing security mitigations like KASLR or SMEP/SMAP.
The resolution involves implementing strict length validation prior to any parsing activity within the wacom_intuos_pro2_bt_irq function. The fix requires checking the received report length against the maximum offset required by whichever device branch is selected, effectively bounding all subsequent sub-parser calls with a single upfront check. For INTUOSP2_BT and related variants, reports shorter than 286 bytes are rejected, while for gen3 devices, those under 46 bytes are discarded. This approach mirrors hardening measures previously applied to the sibling wacom_intuos_bt_irq function, ensuring consistent defensive programming practices across similar drivers. By returning an error code on short reports, the driver avoids executing any further parsing logic that could lead to out-of-bounds access, thereby neutralizing the vulnerability and preventing the leakage of kernel memory contents to untrusted userspace processes.