What is the CVSS score of CVE-2026-63916?

CVE-2026-63916 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63916?

A kernel memory corruption vulnerability in Linux's Wacom HID driver (CVE-2026-63916) affects systems running kernel versions 5.10 through 7.x and could enable memory corruption through specially…. A patch is available.

How to fix or mitigate CVE-2026-63916?

Within 24 hours, audit Linux systems running kernel 5.10-7.x to identify which ones have Wacom HID device support enabled or expose external input device ports. Within 7 days, obtain the vendor-released kernel patch, validate it in a test environment matching production configurations, and stage deployment with rollback procedures. Within 30 days, deploy the patched kernel across all affected production systems using standard change management, verify patching via kernel and driver version checks, and document completion for compliance records.

Linux Kernel CVE-2026-63916

EUVD-2026-45689 HIGH

2026-07-19 Linux

GHSA-r9m8-7m9v-6473

Buffer Overflow Linux

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.8 MEDIUM

Triggered by an attacker-supplied HID device (physical USB, or adjacent for Bluetooth) so AV:P not AV:A; crafting the descriptor is easy (AC:L), no OS auth needed (PR:N), and kernel OOB write yields full C/I/A impact.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:17 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.8 (HIGH)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:55 cve.org

HIGH 8.8

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: Fix OOB write in wacom_hid_set_device_mode()

wacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE usage is always located in the first field (field[0]) of the feature report. However, a device can specify HID_DG_INPUTMODE in a different field.

If HID_DG_INPUTMODE is in a field other than the first one and the first field has a report_count smaller than the usage_index of HID_DG_INPUTMODE, this leads to an out-of-bounds write to r->field[0]->value.

Fix this by storing the field index of HID_DG_INPUTMODE in 'struct hid_data' during feature mapping. In wacom_hid_set_device_mode(), use this stored field index to access the correct field and add bounds checks to ensure both the field index and the value index are within valid ranges before writing.

AnalysisAI

Out-of-bounds kernel write in the Linux wacom HID driver affects the wacom_hid_set_device_mode() routine across long-lived kernel branches (5.10 through 7.x). The driver wrongly assumes the HID_DG_INPUTMODE usage always lives in the report's first field, so a HID device (Wacom-class or a device spoofing one) that places that usage in a later field with a smaller report_count triggers a write past the bounds of r->field[0]->value, corrupting kernel memory. No public exploit is identified at time of analysis and EPSS risk is low (0.21%, 11th percentile), consistent with a bug that requires attacker-supplied hardware rather than remote reachability.

Technical ContextAI

The flaw lives in the HID (Human Interface Device) subsystem of the Linux kernel, specifically the Wacom digitizer driver (drivers/hid/wacom_*). During feature-report processing the driver programs a device into a particular input mode by writing to the HID_DG_INPUTMODE usage. HID reports are structured as an array of fields, each field holding a value[] array sized by its report_count; a device declares this layout in its report descriptor, which the kernel parses at enumeration. The buggy code hardcoded field[0] and used the usage index without validating it against that field's report_count, so a descriptor placing HID_DG_INPUTMODE in a non-first field yields an index beyond the allocated array - a classic out-of-bounds write (CWE-787). The fix stores the correct field index in struct hid_data during feature mapping and adds bounds checks on both the field index and value index before writing. The CPE data (cpe:2.3:a:linux:linux) scopes this to the mainline Linux kernel; CWE is listed N/A in the source but maps to Out-of-bounds Write.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1, or a distribution kernel that has backported the corresponding git.kernel.org commit (e.g. https://git.kernel.org/stable/c/2add311d99646c9d235b2c44f9c169ba30f5db3a). For most operators the correct action is applying the distro kernel update and rebooting. Where immediate patching is not possible, reduce exposure to attacker-supplied HID hardware: blocklist or unbind the wacom driver on systems that do not use Wacom devices (for example blacklist the module via modprobe), and restrict physical/Bluetooth device connection using USBGuard or kernel USB authorization (echo 0 to authorized_default) and by disabling Bluetooth HID pairing on unattended hosts. Trade-offs: blocking or unbinding the module disables legitimate Wacom tablets, and USBGuard/USB-authorization policies can break plug-and-play peripherals and require an allowlist to avoid locking out keyboards/mice. These controls only matter where untrusted devices can be attached; datacenter servers without exposed ports gain little from them.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63916 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63916

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code