CVE-2026-64365

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel letsketch Driver

Publication date: 2026-07-25

Last updated on: 2026-09-04

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrange_timer at driver unbind letsketch_driver does not provide a .remove callback, but letsketch_probe() arms a per-device timer: timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0); The timer is re-armed from letsketch_raw_event() with a 100 ms timeout on every pen-in-range report, and its callback dereferences data->input_tablet to deliver a synthetic BTN_TOOL_PEN release. letsketch_data is allocated with devm_kzalloc(), and its input_dev fields are devm-allocated via letsketch_setup_input_tablet(). On device unbind (USB unplug or rmmod), the HID core runs its default teardown and devm cleanup frees both letsketch_data and the input devices. Because no .remove callback exists, nothing drains the timer first: if raw_event armed it within ~100 ms of the unbind, the pending timer fires on freed memory. This is a UAF read of data and of data->input_tablet, followed by input_report_key() / input_sync() into the freed input_dev. The same problem can occur on the probe error path: if hid_hw_start() enabled I/O on an always-poll-quirk device and then failed, raw_event may have armed the timer before devm releases data. Fix by adding a .remove callback that calls hid_hw_stop() first. hid_hw_stop() synchronously kills the URBs that deliver raw_event(), so once it returns no path can re-arm the timer. timer_shutdown_sync() then drains any in-flight callback and permanently disables further mod_timer() calls. Apply the same timer_shutdown_sync() in the probe error path so the timer is guaranteed not to outlive data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-04

Generated

2026-09-24

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64365

EUVD

EUVD-2026-48909

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 5.17 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	7.2
linux	linux_kernel	7.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's HID letsketch driver. The driver fails to properly clean up a timer when the device is unplugged or the driver is removed. The timer is armed during normal operation but not canceled during cleanup, leading to a potential crash or memory corruption if the timer fires after the associated memory has been freed.

Detection Guidance

This vulnerability is specific to the letsketch HID driver in the Linux kernel and does not have network-based detection methods. It can only be detected through kernel logs or driver-specific checks. Look for kernel oops or panic messages related to the letsketch driver or USB unplug events. Check if the letsketch driver is loaded using commands like lsmod | grep letsketch.

Impact Analysis

This vulnerability could cause system instability, crashes, or potential privilege escalation if exploited. It primarily affects systems using the letsketch HID driver, potentially leading to denial-of-service conditions or memory corruption when the device is disconnected or the driver is unloaded.

Compliance Impact

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's HID letsketch driver, which could lead to memory corruption or crashes. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than kernel-level memory management flaws.

Mitigation Strategies

Apply the kernel patch that adds a .remove callback to the letsketch driver to properly handle device unbind. If a patch is not available, consider unloading the letsketch driver if not in use with rmmod letsketch. Avoid using the letsketch device until an update is applied.

Hi! I’m here to help you understand CVE-2026-64365. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70