CVE-2026-64365 - Vulnerability Details

- HID: letsketch: fix UAF on inrange_timer at driver unbind

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: letsketch: fix UAF on inrange_timer at driver unbind

letsketch_driver does not provide a .remove callback, but
letsketch_probe() arms a per-device timer:

timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0);

The timer is re-armed from letsketch_raw_event() with a 100 ms
timeout on every pen-in-range report, and its callback dereferences
data->input_tablet to deliver a synthetic BTN_TOOL_PEN release.

letsketch_data is allocated with devm_kzalloc(), and its input_dev
fields are devm-allocated via letsketch_setup_input_tablet(). On
device unbind (USB unplug or rmmod), the HID core runs its default
teardown and devm cleanup frees both letsketch_data and the input
devices. Because no .remove callback exists, nothing drains the
timer first: if raw_event armed it within ~100 ms of the unbind,
the pending timer fires on freed memory. This is a UAF read of
data and of data->input_tablet, followed by input_report_key() /
input_sync() into the freed input_dev.

The same problem can occur on the probe error path: if
hid_hw_start() enabled I/O on an always-poll-quirk device and then
failed, raw_event may have armed the timer before devm releases
data.

Fix by adding a .remove callback that calls hid_hw_stop() first.
hid_hw_stop() synchronously kills the URBs that deliver raw_event(),
so once it returns no path can re-arm the timer. timer_shutdown_sync()
then drains any in-flight callback and permanently disables further
mod_timer() calls. Apply the same timer_shutdown_sync() in the probe
error path so the timer is guaranteed not to outlive data.

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The letsketch HID driver in the Linux kernel contains a use‑after‑free flaw that arises when the driver is unbound. The driver starts a per‑device timer during probe, but because it lacks a .remove callback, the timer can still fire after the driver’s memory has been freed during device removal or module unload. When the timer callback executes, it dereferences freed pointers and invokes input report functions on a released input device. This bug can result in a kernel crash or, if exploited, arbitrary kernel‑mode code execution. The flaw is identified as CWE‑825.

Affected Systems

All Linux kernel releases prior to the patch that implements a proper .remove callback are affected. The vulnerability is present in the default letsketch HID driver bundled with all mainstream Linux distributions. Any system that uses a HID device that is managed by this driver and removes the device while the timer is armed is at risk. No specific version string is available, but all kernels older than the patched commit are considered vulnerable.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score is less than 1 %, suggesting a very low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would likely require local access to a compatible HID device and the ability to trigger the device removal while the timer’s 100 ms timeout is still pending, making the attack vector local and dependent on device interaction.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`33a5c2793451770cb6dcf0cc35c76cfd4b045513`	affected	< 2bb6e7143cf70ed281822d26c1848b2897ac36e9
`33a5c2793451770cb6dcf0cc35c76cfd4b045513`	affected	< 523db788c0f84612707638e266e8957ca7e3a756
`33a5c2793451770cb6dcf0cc35c76cfd4b045513`	affected	< 17f5928d7010bc9e002930326b59e60e40c09ee3
`33a5c2793451770cb6dcf0cc35c76cfd4b045513`	affected	< 3eca1a8165b5e7996e699e9df76cb4645e184d42
`33a5c2793451770cb6dcf0cc35c76cfd4b045513`	affected	< df3d8aa1a9392da3de66398e7a03422463806b21
`33a5c2793451770cb6dcf0cc35c76cfd4b045513`	affected	< 46c8beeccd8ab2c863827254a85ea877654a3534

Linux

affected

Version	Status	Constraints
`5.17`	affected	—
`0`	unaffected	< 5.17
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[33a5c2793451770cb6dcf0cc35c76cfd4b045513,2bb6e7143cf70ed281822d26c1848b2897ac36e9)`	affected	code_commit	—
`[33a5c2793451770cb6dcf0cc35c76cfd4b045513,523db788c0f84612707638e266e8957ca7e3a756)`	affected	code_commit	—
`[33a5c2793451770cb6dcf0cc35c76cfd4b045513,17f5928d7010bc9e002930326b59e60e40c09ee3)`	affected	code_commit	—
`[33a5c2793451770cb6dcf0cc35c76cfd4b045513,3eca1a8165b5e7996e699e9df76cb4645e184d42)`	affected	code_commit	—
`[33a5c2793451770cb6dcf0cc35c76cfd4b045513,df3d8aa1a9392da3de66398e7a03422463806b21)`	affected	code_commit	—
`[33a5c2793451770cb6dcf0cc35c76cfd4b045513,46c8beeccd8ab2c863827254a85ea877654a3534)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.17`	affected	generic	—
`[0,5.17)`	unaffected	generic	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes the letsketch driver UAF fix.
If the kernel cannot be updated immediately, avoid unloading the letsketch driver until the device is safely detached so no timer can fire on freed memory.
For custom kernel builds, replace the driver’s remove callback to call hid_hw_stop() followed by timer_shutdown_sync() as described in the patch.

Generated by OpenCVE AI on August 2, 2026 at 13:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/17f5928d7010bc9e002930326b59e60e40c09ee3
https://git.kernel.org/stable/c/2bb6e7143cf70ed281822d26c1848b2897ac36e9
https://git.kernel.org/stable/c/3eca1a8165b5e7996e699e9df76cb4645e184d42
https://git.kernel.org/stable/c/46c8beeccd8ab2c863827254a85ea877654a3534
https://git.kernel.org/stable/c/523db788c0f84612707638e266e8957ca7e3a756
https://git.kernel.org/stable/c/df3d8aa1a9392da3de66398e7a03422463806b21
https://lore.kernel.org/linux-cve-announce/2026072521-CVE-2026-64365-6535@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64365
https://www.cve.org/CVERecord?id=CVE-2026-64365

History

Sat, 01 Aug 2026 02:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-615

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026072521-CVE-2026-64365-6535@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64365 https://www.cve.org/CVERecord?id=CVE-2026-64365
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 26 Jul 2026 02:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-615

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrange_timer at driver unbind letsketch_driver does not provide a .remove callback, but letsketch_probe() arms a per-device timer: timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0); The timer is re-armed from letsketch_raw_event() with a 100 ms timeout on every pen-in-range report, and its callback dereferences data->input_tablet to deliver a synthetic BTN_TOOL_PEN release. letsketch_data is allocated with devm_kzalloc(), and its input_dev fields are devm-allocated via letsketch_setup_input_tablet(). On device unbind (USB unplug or rmmod), the HID core runs its default teardown and devm cleanup frees both letsketch_data and the input devices. Because no .remove callback exists, nothing drains the timer first: if raw_event armed it within ~100 ms of the unbind, the pending timer fires on freed memory. This is a UAF read of data and of data->input_tablet, followed by input_report_key() / input_sync() into the freed input_dev. The same problem can occur on the probe error path: if hid_hw_start() enabled I/O on an always-poll-quirk device and then failed, raw_event may have armed the timer before devm releases data. Fix by adding a .remove callback that calls hid_hw_stop() first. hid_hw_stop() synchronously kills the URBs that deliver raw_event(), so once it returns no path can re-arm the timer. timer_shutdown_sync() then drains any in-flight callback and permanently disables further mod_timer() calls. Apply the same timer_shutdown_sync() in the probe error path so the timer is guaranteed not to outlive data.
Title		HID: letsketch: fix UAF on inrange_timer at driver unbind
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/17f5928d7010bc9e002930326b59e60e40c09ee3 https://git.kernel.org/stable/c/2bb6e7143cf70ed281822d26c1848b2897ac36e9 https://git.kernel.org/stable/c/3eca1a8165b5e7996e699e9df76cb4645e184d42 https://git.kernel.org/stable/c/46c8beeccd8ab2c863827254a85ea877654a3534 https://git.kernel.org/stable/c/523db788c0f84612707638e266e8957ca7e3a756 https://git.kernel.org/stable/c/df3d8aa1a9392da3de66398e7a03422463806b21

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:20.039Z

Updated: 2026-07-25T08:50:20.039Z

Reserved: 2026-07-19T15:36:31.783Z

Link: CVE-2026-64365

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:19.280

Modified: 2026-08-11T15:01:50.637

Link: CVE-2026-64365

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64365 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-02T13:15:03Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object