CVE-2026-68087HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush() wacom_wac_queue_flush() is called via the .raw_event callback (wacom_raw_event → wacom_wac_pen_serial_enforce → wacom_wac_queue_flush). For USB HID devices, this callback is invoked from hid_irq_in(), which is a URB completion handler running in atomic context. Using GFP_KERNEL in this path can sleep, leading to a "scheduling while atomic" bug. Use GFP_ATOMIC instead. The existing code already handles allocation failure by skipping the fifo entry and continuing.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5e013ad206895e72d7da41bc1ae89d8cb499c3aa before bbe1e55629bfaabd4b2e8125b48dd3503d74ac8b; from 5e013ad206895e72d7da41bc1ae89d8cb499c3aa before 27c4dad1b7917b747bf080792a527997e3147c69; from 5e013ad206895e72d7da41bc1ae89d8cb499c3aa before 55f1ad573e34abf9a0443c34bc5a63d74edba7d7 | CNA record |
References
- https://git.kernel.org/stable/c/bbe1e55629bfaabd4b2e8125b48dd3503d74ac8b
- https://git.kernel.org/stable/c/27c4dad1b7917b747bf080792a527997e3147c69
- https://git.kernel.org/stable/c/55f1ad573e34abf9a0443c34bc5a63d74edba7d7
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.