CVE-2026-98499
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
La función 'wacom_wac_pen_serial_enforce()' puede calcular y pasar un desplazamiento no válido a hid_field_extract(), lo que provoca lecturas de memoria en direcciones incorrectas, posiblemente más allá del final del informe. Si un campo del descriptor HID enumera más usages de los que su Report Count realmente reserva espacio, la 'j' interna de la función recorrerá más allá del final del campo:
Un descriptor que enumera 12288 usages frente a un Report Count de 1 hace que el bucle extraiga el usage en el índice 12287 desde el desplazamiento de bit 98296, unos 12 KB más allá de un informe recibido de 2 bytes.
Leer descripción completaMostrar menos
El valor se almacena en wacom_wac->serial[0] y puede llegar al espacio de usuario como un evento MSC_SERIAL, lo que supone una divulgación de información.
Se limita el bucle a field->report_count, es decir, al número de ranuras de valor que contiene el informe. Las ranuras de valor posteriores al último usage declarado siguen escaneándose; reutilizan ese usage (HID 1.11, 6.2.2.8).
Verificado en v6.12.105 con un reproductor UHID: un informe de 2 bytes procedente de un descriptor de este tipo activa KASAN antes del parche y no después de él.
Detalles técnicos trazas, registros y código del informe original
for (i = 0; i < report->maxfield; i++) {
for (j = 0; j < report->field[i]->maxusage; j++) {
...
value = hid_field_extract(hdev, raw_data + 1,
offset + j * size, size);Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/26471d954bbfbfb9032994f7f485802ee20e0582
- https://git.kernel.org/stable/c/456afe4707e23cc114ad833197f63b52bb8fd1e7
- https://git.kernel.org/stable/c/4b09b7c84b8633cd041181616bd15bf5e73c164d
- https://git.kernel.org/stable/c/65e7c4b5366b770c60dfefac3f1d06e33a9e411e
- https://git.kernel.org/stable/c/9aa237cf66495b2426ddde8532e9b08a0ed83aaa
- https://git.kernel.org/stable/c/9aa62f967b6a4bb30aa3b778e02c8a5ca6bcde51
- https://git.kernel.org/stable/c/c3129e6f26e18c0886ede7265f187a7ec289e1d1
- https://git.kernel.org/stable/c/eaa7d29341ef4b91e84ad097562982288a7c376c
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98499",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "83417206427bdf0fef9fa69957807194f25923c3",
"lessThan": "9aa62f967b6a4bb30aa3b778e02c8a5ca6bcde51",
"versionType": "git"
},
{
"status": "affected",
"version": "83417206427bdf0fef9fa69957807194f25923c3",
"lessThan": "26471d954bbfbfb9032994f7f485802ee20e0582",
"versionType": "git"
},
{
"status": "affected",
"version": "83417206427bdf0fef9fa69957807194f25923c3",
"lessThan": "456afe4707e23cc114ad833197f63b52bb8fd1e7",
"versionType": "git"
},
{
"status": "affected",
"version": "83417206427bdf0fef9fa69957807194f25923c3",
"lessThan": "65e7c4b5366b770c60dfefac3f1d06e33a9e411e",
"versionType": "git"
},
{
"status": "affected",
"version": "83417206427bdf0fef9fa69957807194f25923c3",
"lessThan": "eaa7d29341ef4b91e84ad097562982288a7c376c",
"versionType": "git"
},
{
"status": "affected",
"version": "83417206427bdf0fef9fa69957807194f25923c3",
"lessThan": "c3129e6f26e18c0886ede7265f187a7ec289e1d1",
"versionType": "git"
},
{
"status": "affected",
"version": "83417206427bdf0fef9fa69957807194f25923c3",
"lessThan": "4b09b7c84b8633cd041181616bd15bf5e73c164d",
"versionType": "git"
},
{
"status": "affected",
"version": "83417206427bdf0fef9fa69957807194f25923c3",
"lessThan": "9aa237cf66495b2426ddde8532e9b08a0ed83aaa",
"versionType": "git"
}
],
"programFiles": [
"drivers/hid/wacom_sys.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.16",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/hid/wacom_sys.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:00.913",
"references": [
{
"url": "https://git.kernel.org/stable/c/26471d954bbfbfb9032994f7f485802ee20e0582",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/456afe4707e23cc114ad833197f63b52bb8fd1e7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4b09b7c84b8633cd041181616bd15bf5e73c164d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/65e7c4b5366b770c60dfefac3f1d06e33a9e411e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9aa237cf66495b2426ddde8532e9b08a0ed83aaa",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9aa62f967b6a4bb30aa3b778e02c8a5ca6bcde51",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c3129e6f26e18c0886ede7265f187a7ec289e1d1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/eaa7d29341ef4b91e84ad097562982288a7c376c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()\n\nThe 'wacom_wac_pen_serial_enforce()' function may calculate and pass an\ninvalid offset to hid_field_extract(), resulting in memory reads at\nincorrect addresses -- possibly beyond the end of the report. If a\nfield in the HID descriptor lists more usages than its Report Count\nactually reserves space for, the function's inner 'j' will walk past\nthe end of the field:\n\n\tfor (i = 0; i < report->maxfield; i++) {\n\t\tfor (j = 0; j < report->field[i]->maxusage; j++) {\n\t\t\t...\n\t\t\tvalue = hid_field_extract(hdev, raw_data + 1,\n\t\t\t\t\t\t offset + j * size, size);\n\nA descriptor listing 12288 usages against Report Count 1 has the loop\nextract the usage at index 12287 from bit offset 98296 -- about 12 KB\npast a 2-byte received report. The value is stored in\nwacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event,\nmaking this an information disclosure.\n\nClamp the loop to field->report_count, the number of value slots the\nreport holds. Value slots past the last declared usage are still\nscanned; they reuse that usage (HID 1.11, 6.2.2.8).\n\nVerified on v6.12.105 with a UHID reproducer: a 2-byte report from\nsuch a descriptor trips KASAN before the patch and not after it."
}
],
"lastModified": "2026-10-19T10:19:02.837",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}