CVE-2026-64366

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: fix slab-out-of-bounds write in wacomwacqueue_insert

wacomwacqueueinsert() calls kfifoskip() in a loop when the kfifo doesn't have enough space for the incoming report. If the kfifo is empty, kfifo_skip() reads stale data left in the kmalloc'd buffer via __kfifopeekn() and interprets it as a record length, advancing fifo->out by that garbage value. This corrupts the internal kfifo state, causing kfifo_unused() to return a value much larger than the actual buffer size, which bypasses __kfifoinr()'s guard:

if (len + recsize > kfifo_unused(fifo)) return 0;

kfifocopyin() then performs an out-of-bounds memcpy, writing up to 3842 bytes past the 256-byte buffer.

Add a !kfifoisempty() condition to the while loop so kfifoskip() is never called on an empty fifo, and check the return value of kfifoin() to reject reports that are too large for the fifo.