CVE-2026-64365
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrange_timer at driver unbind letsketch_driver does not provide a .remove callback, but letsketch_probe() arms a per-device timer: timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0); The timer is re-armed from letsketch_raw_event() with a 100 ms timeout on every pen-in-range report, and its callback dereferences data->input_tablet to deliver a synthetic BTN_TOOL_PEN release. letsketch_data is allocated with devm_kzalloc(), and its input_dev fields are devm-allocated via letsketch_setup_input_tablet(). On device unbind (USB unplug or rmmod), the HID core runs its default teardown and devm cleanup frees both letsketch_data and the input devices. Because no .remove callback exists, nothing drains the timer first: if raw_event armed it within ~100 ms of the unbind, the pending timer fires on freed memory. This is a UAF read of data and of data->input_tablet, followed by input_report_key() / input_sync() into the freed input_dev. The same problem can occur on the probe error path: if hid_hw_start() enabled I/O on an always-poll-quirk device and then failed, raw_event may have armed the timer before devm releases data. Fix by adding a .remove callback that calls hid_hw_stop() first. hid_hw_stop() synchronously kills the URBs that deliver raw_event(), so once it returns no path can re-arm the timer. timer_shutdown_sync() then drains any in-flight callback and permanently disables further mod_timer() calls. Apply the same timer_shutdown_sync() in the probe error path so the timer is guaranteed not to outlive data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64365
EUVD
EUVD-2026-48909

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
letsketch letsketch_driver *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's HID letsketch driver. The driver fails to properly clean up a timer when the device is unplugged or the driver is removed. The timer is armed during normal operation but not canceled during cleanup, leading to a potential crash or memory corruption if the timer fires after the associated memory has been freed.

Detection Guidance

This vulnerability is specific to the letsketch HID driver in the Linux kernel and does not have network-based detection methods. It can only be detected through kernel logs or driver-specific checks. Look for kernel oops or panic messages related to the letsketch driver or USB unplug events. Check if the letsketch driver is loaded using commands like lsmod | grep letsketch.

Impact Analysis

This vulnerability could cause system instability, crashes, or potential privilege escalation if exploited. It primarily affects systems using the letsketch HID driver, potentially leading to denial-of-service conditions or memory corruption when the device is disconnected or the driver is unloaded.

Mitigation Strategies

Apply the kernel patch that adds a .remove callback to the letsketch driver to properly handle device unbind. If a patch is not available, consider unloading the letsketch driver if not in use with rmmod letsketch. Avoid using the letsketch device until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64365. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart