CVE-2023-53797: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53797 is a vulnerability in the Linux kernel's HID (Human Interface Device) Wacom driver caused by incorrect use of the int type instead of ktime_t when handling timestamps. The int type lacks sufficient storage capacity for values returned by functions like ktime_get, resulting in integer overflows when calculating or storing timestamps. These overflows cause incorrect timestamp values to be reported to userspace, and in some cases make input handling in userspace appear hung. The vulnerability affects multiple Linux kernel stable branches, with fixes backported to versions 5.4.251, 5.10.188, 5.15.120, 6.1.37, 6.3.11, 6.4.1, and 6.5+. It was published on December 9, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.024% (Feedly).

The root cause is an integer overflow (CWE-190) in the Linux kernel's drivers/hid/wacom_sys.c or related Wacom HID driver code, where timestamp values obtained from ktime_get() are stored in int-typed variables rather than the appropriate ktime_t type. Because ktime_t is a 64-bit type and int is typically 32 bits, the truncation causes arithmetic overflows during timestamp calculation and storage. The fix replaces int with ktime_t throughout the relevant timestamp-handling code paths. Patches are available across multiple stable kernel trees (Feedly, Kernel Git).

The primary impact is incorrect timestamp data being reported to userspace from Wacom HID input devices, which can cause input handling to appear frozen or unresponsive. This is an availability and integrity issue limited to systems using Wacom tablet/stylus hardware; there is no evidence of confidentiality impact, privilege escalation, or remote code execution potential. The scope is confined to the local system and specifically to the behavior of Wacom input devices (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2023-53797. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. Exploitation would require local access to a system with a Wacom HID device attached, and the impact is limited to input device misbehavior rather than system compromise (Feedly).

Update the Linux kernel to a version containing the fix: 5.4.251, 5.10.188, 5.15.120, 6.1.37, 6.3.11, 6.4.1, or 6.5 and later. Patches have been applied across multiple stable kernel branches and are available via the upstream kernel stable repositories. No configuration-based workaround is known; upgrading the kernel is the recommended remediation. SUSE has also issued advisories incorporating these fixes for affected SUSE Linux Enterprise products (Feedly, Linux Security).