{
  "cveId": "CVE-2026-64366",
  "url": "https://patchblox.com/security/cve/CVE-2026-64366",
  "summary": "CVE-2026-64366 is fixed in linux on 1 platform by DEBIAN-CVE-2026-64366 (version 7.1.4-1), released August 7, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  HID: wacom: fix slab-out-of-bounds write in waco...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert  wacom_wac_queue_insert() calls kfifo_skip() in a loop when the kfifo doesn\u0027t have enough space for the incoming report. If the kfifo is empty, kfifo_skip() reads stale data left in the kmalloc\u0027d buffer via __kfifo_peek_n() and interprets it as a record length, advancing fifo-\u003Eout by that garbage value. This corrupts the internal kfifo state, causing kfifo_unused() to return a value much larger than the actual buffer size, which bypasses __kfifo_in_r()\u0027s guard:    if (len \u002B recsize \u003E kfifo_unused(fifo))       return 0;  kfifo_copy_in() then performs an out-of-bounds memcpy, writing up to 3842 bytes past the 256-byte buffer.  Add a !kfifo_is_empty() condition to the while loop so kfifo_skip() is never called on an empty fifo, and check the return value of kfifo_in() to reject reports that are too large for the fifo.",
  "published": "2026-07-25T10:17:19Z",
  "severity": "high",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00398,
  "epssPercentile": 0.34283,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.4-1",
      "fix": "DEBIAN-CVE-2026-64366",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64366",
      "released": "2026-08-07T15:22:10Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}