CVE-2026-63916

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: Fix OOB write in wacomhidsetdevicemode()

wacomhidsetdevicemode() currently assumes that the HIDDGINPUTMODE usage is always located in the first field (field[0]) of the feature report. However, a device can specify HIDDGINPUTMODE in a different field.

If HIDDGINPUTMODE is in a field other than the first one and the first field has a reportcount smaller than the usageindex of HIDDGINPUTMODE, this leads to an out-of-bounds write to r->field[0]->value.

Fix this by storing the field index of HIDDGINPUTMODE in 'struct hiddata' during feature mapping. In wacomhidsetdevice_mode(), use this stored field index to access the correct field and add bounds checks to ensure both the field index and the value index are within valid ranges before writing.