01 Record

CVE-2026-89999

HID: wacom: validate report length in wacom_intuos_pro2_bt_irq

HighPUBLISHEDCNA: Linux

CNA base score8.1 CVSS v3.xCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

View raw JSON

02 Description

HID: wacom: validate report length in wacom_intuos_pro2_bt_irq

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.37% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 30.6% of scored records. A rank, not a probability.
NVD base score: 8.1 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
NVD analysis status: Received. NVD last modified this record on 2026-10-19.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published: 2026-09-16 10:33Z1 MO AGO
Last updated: 2026-10-19 08:56Z10 DAYS AGO
Reserved: 2026-09-11
Assigning CNA: Linux
Record state: PUBLISHED
Severity: High (CVSS 8.1)
CNA CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weaknesses: No CWE assigned
Data version: 5.2
Document digest: c332ddaa44383649d6267aa75635399b243eae42a9cc2ed835e7dbd9e1a87ade

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b to < d2844f3fcd058113acbe0aa110ab13ef28b98d9f, 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b to < 1bfc0547b81d5861443420d19b5ed2fd533cd17f, 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b to < 84781a1f3c5dc6650480be9329e6e8528939eaa0, 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b to < 96dd0af7597aba2d80cc97e2f66e8b72d30ba125, 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b to < 114af803e409a68e52516810ecd24df4d8ce0c68, 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b to < 74ec08f7b81c2726578039ca6dea0fec136c38ea, 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b to < 0cdc6cb242dd8d2731956fdf3390de094482a4b2, 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b to < a8e04f3f894ccb52cfcd7e60125a9f35da4a616d, 4.11—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/d2844f3fcd058113acbe0aa110ab13ef28b98d9f
git.kernel.orghttps://git.kernel.org/stable/c/1bfc0547b81d5861443420d19b5ed2fd533cd17f
git.kernel.orghttps://git.kernel.org/stable/c/84781a1f3c5dc6650480be9329e6e8528939eaa0
git.kernel.orghttps://git.kernel.org/stable/c/96dd0af7597aba2d80cc97e2f66e8b72d30ba125
git.kernel.orghttps://git.kernel.org/stable/c/114af803e409a68e52516810ecd24df4d8ce0c68
git.kernel.orghttps://git.kernel.org/stable/c/74ec08f7b81c2726578039ca6dea0fec136c38ea
git.kernel.orghttps://git.kernel.org/stable/c/0cdc6cb242dd8d2731956fdf3390de094482a4b2
git.kernel.orghttps://git.kernel.org/stable/c/a8e04f3f894ccb52cfcd7e60125a9f35da4a616d

07 Fixed in

Debian 12

linux
Fixed in 6.1.190-1
linux-6.12
Fixed in 6.12.111-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.111-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.2.6-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.