CVE-2026-64366

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-out-of-bounds write exists in the wacom wac queue insert() function. The issue occurs when the function calls kfifo skip() in a loop because the kfifo lacks sufficient space for an incoming report. If the kfifo is empty, kfifo skip() reads stale data from the kmalloc'd buffer via kfifo peek n() and incorrectly interprets it as a record length. This corrupts the internal kfifo state, causing kfifo unused() to return a value exceeding the actual buffer size, which bypasses the guard in kfifo in r(). Consequently, kfifo copy in() performs an out-of-bounds memcpy, potentially writing up to 3842 bytes beyond the 256-byte buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.