Linux Kernel CVE-2026-89999

Requires a Bluetooth peripheral (real, malfunctioning, or spoofed) that advertises a Wacom Intuos Pro/Intuos BT VID/PID present in the driver's id_table so features.type is set and wacom_setup_device_quirks() force-registers the pen/pad/touch inputs regardless of the report descriptor; the attacker device must be paired/bound to the target and then send a report that passes the data[0]==0x80/0x81 report-id gate but is shorter than the branch minimum (286 bytes for INTUOSP2_BT/INTUOSP2S_BT, 46 bytes for the gen3 INTUOSHT3_BT branch). Limiting factors: adjacency (Bluetooth range), the practical need to pair/trust the malicious device, the CONFIG requirement that the wacom driver be built and a matching Wacom BT device profile be bound, and that reliable confidentiality impact needs a local userspace process reading the evdev nodes to harvest the leaked bytes; without that, the observable effect is an OOB read/crash.

This is a genuine but bounded-severity local/adjacent kernel bug, not a network-facing critical. The vendor CVSS of 8.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) overstates confidentiality: the flaw is an out-of-bounds READ (CWE-125), not a write, and the leaked data is only a small number of bytes past a small backing buffer, reachable to userspace through an awkward evdev channel (MSC_SERIAL/ABS_MISC/ABS_WHEEL on the pen/pad nodes) that a local process must read back - so C:H is better characterized as C:L, with the reliable impact being a kernel crash (A:H, DoS) on transports whose buffer is sized to the report descriptor. The AV:A (Bluetooth adjacent) is correct, but the vector's UI:N is optimistic: exploitation requires a malicious/spoofed Bluetooth peripheral that advertises a specific Wacom VID/PID and is paired/bound to the host, which in practice implies user pairing action (UI:R). There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so exploitation status is 'no public exploit identified.' Net: a real correctness/hardening fix worth patching on affected fleets, but far from an emergency - targeted, proximity-gated, and DoS-dominant rather than a widely-automatable data-theft primitive.

An attacker within Bluetooth range presents a rogue peripheral that spoofs the VID/PID of a Wacom Intuos Pro/Intuos BT tablet and gets it paired to the victim host. Once bound, the device sends a report that passes the data[0]==0x80/0x81 report-id gate but is shorter than the 286-byte (INTUOSP2_BT/INTUOSP2S_BT) or 46-byte (gen3) minimum the sub-parsers assume, causing the driver to read past the buffer and either leak adjacent kernel bytes to userspace via evdev or crash the kernel. No public exploit code is identified at time of analysis.