CVE-2026-63916

Estado: Pendiente de análisisAlta (8.8)—

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: Fix OOB write in wacom_hid_set_device_mode()

wacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE usage is always located in the first field (field[0]) of the feature report. However, a device can specify HID_DG_INPUTMODE in a different field.

If HID_DG_INPUTMODE is in a field other than the first one and the first field has a report_count smaller than the usage_index of HID_DG_INPUTMODE, this leads to an out-of-bounds write to r->field[0]->value.

Fix this by storing the field index of HID_DG_INPUTMODE in 'struct hid_data' during feature mapping.

Leer descripción completaMostrar menos

In wacom_hid_set_device_mode(), use this stored field index to access the correct field and add bounds checks to ensure both the field index and the value index are within valid ranges before writing.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 8.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.41%
Percentil entre todas las CVEs puntuadas: 33
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement45 %
Impacto principalT1068 Exploitation for Privilege Escalationprivilege escalation75 %
Impacto secundarioT1499.004 Application or System Exploitationimpact60 %

AV:A (red adyacente) sugiere T1210. El OOB write en kernel permite escalada de privilegios (impacto primario) o DoS por corrupción de memoria; requiere dispositivo HID malicioso conectado localmente.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Application Isolation and Sandboxing Exploit Protection Update Software Vulnerability Scanning Privileged Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-63916",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5ae6e89f7409cb5d218bb728326eba9c650d9700",
              "lessThan": "2add311d99646c9d235b2c44f9c169ba30f5db3a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5ae6e89f7409cb5d218bb728326eba9c650d9700",
              "lessThan": "83bd8a5756a3c4a413ed8f6253f9eb2821e1ccaf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5ae6e89f7409cb5d218bb728326eba9c650d9700",
              "lessThan": "5716a293fb19d382ca2336e08fd28a619a5f3c25",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5ae6e89f7409cb5d218bb728326eba9c650d9700",
              "lessThan": "ed598de9f61582902406d352d99f2073d8e00298",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5ae6e89f7409cb5d218bb728326eba9c650d9700",
              "lessThan": "43e7c02d6090a82fd60d63491f6871aec906345e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5ae6e89f7409cb5d218bb728326eba9c650d9700",
              "lessThan": "b8338111e14183972359009c12d0dbd81d2e1e16",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5ae6e89f7409cb5d218bb728326eba9c650d9700",
              "lessThan": "5db3fca0cec7b33bc5379411d0a60d792c9f9bc0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5ae6e89f7409cb5d218bb728326eba9c650d9700",
              "lessThan": "c0a8899e02ddebd51e2589835182c239c2e224ae",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/hid/wacom_sys.c",
            "drivers/hid/wacom_wac.h"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.18",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.*"
            },
            {
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/hid/wacom_sys.c",
            "drivers/hid/wacom_wac.h"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-07-19T16:17:09.657",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2add311d99646c9d235b2c44f9c169ba30f5db3a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/43e7c02d6090a82fd60d63491f6871aec906345e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5716a293fb19d382ca2336e08fd28a619a5f3c25",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5db3fca0cec7b33bc5379411d0a60d792c9f9bc0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/83bd8a5756a3c4a413ed8f6253f9eb2821e1ccaf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b8338111e14183972359009c12d0dbd81d2e1e16",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c0a8899e02ddebd51e2589835182c239c2e224ae",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ed598de9f61582902406d352d99f2073d8e00298",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: Fix OOB write in wacom_hid_set_device_mode()\n\nwacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE\nusage is always located in the first field (field[0]) of the feature report.\nHowever, a device can specify HID_DG_INPUTMODE in a different field.\n\nIf HID_DG_INPUTMODE is in a field other than the first one and the first\nfield has a report_count smaller than the usage_index of HID_DG_INPUTMODE,\nthis leads to an out-of-bounds write to r->field[0]->value.\n\nFix this by storing the field index of HID_DG_INPUTMODE in 'struct\nhid_data' during feature mapping.  In wacom_hid_set_device_mode(), use\nthis stored field index to access the correct field and add bounds\nchecks to ensure both the field index and the value index are within\nvalid ranges before writing."
    }
  ],
  "lastModified": "2026-07-27T17:44:23.777",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}