{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.190-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()  The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an invalid offset to hid_field_extract(), resulting in memory reads at incorrect addresses -- possibly beyond the end of the report.  If a field in the HID descriptor lists more usages than its Report Count actually reserves space for, the function's inner 'j' will walk past the end of the field:  \tfor (i = 0; i \u003c report-\u003emaxfield; i++) { \t\tfor (j = 0; j \u003c report-\u003efield[i]-\u003emaxusage; j++) { \t\t\t... \t\t\tvalue = hid_field_extract(hdev, raw_data + 1, \t\t\t\t\t\t  offset + j * size, size);  A descriptor listing 12288 usages against Report Count 1 has the loop extract the usage at index 12287 from bit offset 98296 -- about 12 KB past a 2-byte received report.  The value is stored in wacom_wac-\u003eserial[0] and can reach userspace as an MSC_SERIAL event, making this an information disclosure.  Clamp the loop to field-\u003ereport_count, the number of value slots the report holds.  Value slots past the last declared usage are still scanned; they reuse that usage (HID 1.11, 6.2.2.8).  Verified on v6.12.105 with a UHID reproducer: a 2-byte report from such a descriptor trips KASAN before the patch and not after it.",
  "id": "DEBIAN-CVE-2026-98499",
  "modified": "2026-10-19T04:47:32.593943572Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98499"
    }
  ],
  "upstream": [
    "CVE-2026-98499"
  ]
}