Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short report can trigger an out-of-bounds read when copying data into the wacom structure.
Specifically, report 0x03 requires at least 22 bytes to safely read the processed data and battery status, while report 0x04 (which falls through to 0x03) requires 32 bytes.
Add explicit length checks for these report IDs and log a warning if a short report is received.
Details
- Affected product:
- AlmaLinux 9.2 ESU , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , Oracle Linux 7 ELS , RHEL 7 ELS , TuxCare 9.6 ESU , Ubuntu 20.04 ELS
- Affected packages:
- kernel @ 5.14.0 (+8 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| AlmaLinux 10 | Released |
37 kernels
|
| AlmaLinux 8 | Released |
105 kernels
|
| AlmaLinux 9 | Released |
107 kernels
|
| AlmaLinux 9.2 ESU | Released |
23 kernels
|
| AlmaLinux 9.6 ESU | Released |
11 kernels
|
| CentOS 7 ELS | Planned | — |
| CentOS 8 | Released |
21 kernels
|
| CloudLinux OS 7h | Released |
102 kernels
|
| CloudLinux OS 8 | Released |
99 kernels
|
| Debian 11 | Released |
37 kernels
|
| Debian 11 cloud | Released |
17 kernels
|
| Debian 12 | Released |
35 kernels
|
| Debian 13 | Planned | — |
| Oracle Linux 8 | Released |
115 kernels
|
| Oracle Linux 9 | Released |
109 kernels
|
| RHEL 10 | Released |
37 kernels
|
| RHEL 8 | Released |
110 kernels
|
| RHEL 9 | Released |
105 kernels
|
| Rocky Linux 10 | Released |
27 kernels
|
| Rocky Linux 8 | Released |
88 kernels
|
| Rocky Linux 9 | Released |
86 kernels
|
| Ubuntu 22.04 | Planned | — |
| Ubuntu 24.04 | Planned | — |