CVE-2016-3139 json
The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause…
published 2016-04-27 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-4191
- cvss
- 4.6
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.8%
- EPSS 1.8% chance of exploitation in 30 days, percentile 78%
- public exploits
- 1
- Exploit-DB
Summary
The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
Patch / fix
- linux Debian 14, Debian 13, Debian 12 4.0.2-1
debian advisories DEBIAN-CVE-2016-3139
- kernel-rt SLE Real Time 12 SP1 3.12.58-14.1
- kernel-compute SLE Real Time 12 SP1 3.12.58-14.1
- kernel-syms-rt SLE Real Time 12 SP1 3.12.58-14.1
- kernel-rt_debug SLE Real Time 12 SP1 3.12.58-14.1
- kernel-source-rt SLE Real Time 12 SP1 3.12.58-14.1
- kernel-compute_debug SLE Real Time 12 SP1 3.12.58-14.1
- kernel-rt SLE Real Time 11 SP4 3.0.101.rt130-54.1
- kernel-syms-rt SLE Real Time 11 SP4 3.0.101.rt130-54.1
suse advisories SUSE-SU-2016:2074-1SUSE-SU-2016:1764-1SUSE-SU-2016:1707-1SUSE-SU-2016:1690-1SUSE-SU-2016:1672-1SUSE-SU-2016:1203-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2016-3139 updated cvss 4.9
kernel: Crash on invalid USB device descriptors (wacom driver)
-
Red Hat Enterprise Linux 5 kernel Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise MRG 2 kernel-rt, mrg-rt-release, kernel-rt-trace, kernel-rt-vanilla, kernel-rt-firmwareaffected: no fix planned “Will not fix”
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (EDB-39538)
- Published
Exploit prediction
1.79% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-39538 Linux Kernel 3.10.0 (CentOS / RHEL 7.1) - 'Wacom' Multiple Nullpointer Dereferences dos, 2016-03-09
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 4.6 | CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.9 | AV:L/AC:L/Au:N/C:N/I:N/A:C |
Classification
- Technology feeds
References
- git.kernel.org /cgit/linux/kernel/git/torvalds/linux.git/commit/?id=471d17148c8b4174ac5f5283a73316d12c4379bc
- github.com /torvalds/linux/commit/471d17148c8b4174ac5f5283a73316d12c4379bc
-
exploit-db.com
/exploits/39538/
exploit
-
lists.opensuse.org
/opensuse-security-announce/2016-06/msg00054.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-07/msg00005.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-06/msg00059.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-06/msg00052.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-04/msg00019.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-08/msg00038.html
vendor-advisory
- bugzilla.redhat.com /show_bug.cgi?id=1316993
- bugzilla.redhat.com /show_bug.cgi?id=1283377
- security-tracker.debian.org /tracker/CVE-2016-3139
- bugzilla.redhat.com /show_bug.cgi?id=1283375
Sources
- CVE List CVE-2016-3139
- NVD CVE-2016-3139
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.