CVE-2026-63916

A flaw was found in the Linux kernel's Human Interface Device (HID) wacom driver. The wacom_hid_set_device_mode() function incorrectly handles the location of input mode data within a device's report. This can lead to an out-of-bounds write, where the system attempts to write data beyond the allocated memory buffer. Such memory corruption could potentially allow a local attacker to cause system instability or escalate privileges.

Red Hat has evaluated this issue as having a Moderate security impact because exploitation requires connecting a specially crafted HID device or having access to an emulated input device in a virtualized guest. In typical enterprise server deployments, physical USB access is restricted and graphical tablet hardware is uncommon, significantly limiting the attack surface. An attacker with physical access or guest-to-host device control could trigger memory corruption leading to system crashes or potential privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.