Linux Kernel CVE-2026-98499

Exploitation requires the attacker to present a crafted HID report descriptor in which a field lists more usages than its Report Count reserves (the description cites 12288 usages against Report Count 1), and the device must be handled by the Wacom pen path so that wacom_wac_pen_serial_enforce() processes its reports. The trigger is a short (e.g. 2-byte) report from such a device. Limiting factors: the attacker must be able to attach or emulate a malicious HID peripheral bound by the wacom driver - practically physical access for USB tablets or radio proximity for Bluetooth HID (consistent with AV:A); no authentication (PR:N) and no user interaction beyond device attachment are required, but normal/honest Wacom hardware does not trigger the flaw, so a hostile or spoofed device is essential.

The CVSS 3.1 base score of 8.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) frames this as a high-severity adjacent, unauthenticated flaw, but the signals diverge sharply from that headline. EPSS is only 0.21% (11th percentile), the CVE is not in CISA KEV, and no public exploit reference is supplied - the only references are the kernel.org stable fix commits. The vuln.today decision label is this_week, i.e. prompt patching rather than emergency. Crucially, the mechanism is an out-of-bounds read in the Wacom HID pen driver triggered only when a device presents a malicious HID descriptor (more usages than Report Count reserves); exploitation therefore requires the attacker to supply or emulate a crafted HID peripheral that is bound by the wacom driver. CVSS encodes AV:A (consistent with a Bluetooth HID peripheral), yet for a USB tablet the realistic requirement is physical connection - verify the intended transport, as this materially changes reachability. The impact is a kernel-memory information disclosure (up to ~12 KB past a 2-byte report leaked into wacom_wac->serial[0] and surfaced to userspace as MSC_SERIAL); the A:H likely reflects potential oops/fault on the OOB access rather than a confirmed DoS primitive. Net: a genuine kernel OOB read worth patching on the vendor's this_week cadence, but not a widespread-exploitation emergency - low EPSS, no KEV, and a peripheral-dependent trigger make opportunistic mass exploitation implausible; risk concentrates where untrusted HID devices can be attached.

An attacker who can attach or emulate an HID peripheral (e.g. a crafted USB tablet, or a Bluetooth HID device within radio range) presents a report descriptor that declares far more usages than its Report Count reserves. When the device sends a short report, wacom_wac_pen_serial_enforce() walks past the field and reads adjacent kernel memory, which is then exposed to userspace as an MSC_SERIAL input event. The description notes a UHID reproducer was used to verify the flaw (KASAN trips before the patch), but no weaponized public exploit is referenced in the input.