{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64365", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.783Z", "datePublished": "2026-07-25T08:50:20.039Z", "dateUpdated": "2026-07-25T08:50:20.039Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-25T08:50:20.039Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: letsketch: fix UAF on inrange_timer at driver unbind\n\nletsketch_driver does not provide a .remove callback, but\nletsketch_probe() arms a per-device timer:\n\n timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0);\n\nThe timer is re-armed from letsketch_raw_event() with a 100 ms\ntimeout on every pen-in-range report, and its callback dereferences\ndata->input_tablet to deliver a synthetic BTN_TOOL_PEN release.\n\nletsketch_data is allocated with devm_kzalloc(), and its input_dev\nfields are devm-allocated via letsketch_setup_input_tablet(). On\ndevice unbind (USB unplug or rmmod), the HID core runs its default\nteardown and devm cleanup frees both letsketch_data and the input\ndevices. Because no .remove callback exists, nothing drains the\ntimer first: if raw_event armed it within ~100 ms of the unbind,\nthe pending timer fires on freed memory. This is a UAF read of\ndata and of data->input_tablet, followed by input_report_key() /\ninput_sync() into the freed input_dev.\n\nThe same problem can occur on the probe error path: if\nhid_hw_start() enabled I/O on an always-poll-quirk device and then\nfailed, raw_event may have armed the timer before devm releases\ndata.\n\nFix by adding a .remove callback that calls hid_hw_stop() first.\nhid_hw_stop() synchronously kills the URBs that deliver raw_event(),\nso once it returns no path can re-arm the timer. timer_shutdown_sync()\nthen drains any in-flight callback and permanently disables further\nmod_timer() calls. Apply the same timer_shutdown_sync() in the probe\nerror path so the timer is guaranteed not to outlive data."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hid/hid-letsketch.c"], "versions": [{"version": "33a5c2793451770cb6dcf0cc35c76cfd4b045513", "lessThan": "2bb6e7143cf70ed281822d26c1848b2897ac36e9", "status": "affected", "versionType": "git"}, {"version": "33a5c2793451770cb6dcf0cc35c76cfd4b045513", "lessThan": "523db788c0f84612707638e266e8957ca7e3a756", "status": "affected", "versionType": "git"}, {"version": "33a5c2793451770cb6dcf0cc35c76cfd4b045513", "lessThan": "17f5928d7010bc9e002930326b59e60e40c09ee3", "status": "affected", "versionType": "git"}, {"version": "33a5c2793451770cb6dcf0cc35c76cfd4b045513", "lessThan": "3eca1a8165b5e7996e699e9df76cb4645e184d42", "status": "affected", "versionType": "git"}, {"version": "33a5c2793451770cb6dcf0cc35c76cfd4b045513", "lessThan": "df3d8aa1a9392da3de66398e7a03422463806b21", "status": "affected", "versionType": "git"}, {"version": "33a5c2793451770cb6dcf0cc35c76cfd4b045513", "lessThan": "46c8beeccd8ab2c863827254a85ea877654a3534", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hid/hid-letsketch.c"], "versions": [{"version": "5.17", "status": "affected"}, {"version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.12.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.2-rc3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2bb6e7143cf70ed281822d26c1848b2897ac36e9"}, {"url": "https://git.kernel.org/stable/c/523db788c0f84612707638e266e8957ca7e3a756"}, {"url": "https://git.kernel.org/stable/c/17f5928d7010bc9e002930326b59e60e40c09ee3"}, {"url": "https://git.kernel.org/stable/c/3eca1a8165b5e7996e699e9df76cb4645e184d42"}, {"url": "https://git.kernel.org/stable/c/df3d8aa1a9392da3de66398e7a03422463806b21"}, {"url": "https://git.kernel.org/stable/c/46c8beeccd8ab2c863827254a85ea877654a3534"}], "title": "HID: letsketch: fix UAF on inrange_timer at driver unbind", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/hid/hid-letsketch.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2bb6e7143cf70ed281822d26c1848b2897ac36e9", "status": "affected", "version": "33a5c2793451770cb6dcf0cc35c76cfd4b045513", "versionType": "git"}, {"lessThan": "523db788c0f84612707638e266e8957ca7e3a756", "status": "affected", "version": "33a5c2793451770cb6dcf0cc35c76cfd4b045513", "versionType": "git"}, {"lessThan": "17f5928d7010bc9e002930326b59e60e40c09ee3", "status": "affected", "version": "33a5c2793451770cb6dcf0cc35c76cfd4b045513", "versionType": "git"}, {"lessThan": "3eca1a8165b5e7996e699e9df76cb4645e184d42", "status": "affected", "version": "33a5c2793451770cb6dcf0cc35c76cfd4b045513", "versionType": "git"}, {"lessThan": "df3d8aa1a9392da3de66398e7a03422463806b21", "status": "affected", "version": "33a5c2793451770cb6dcf0cc35c76cfd4b045513", "versionType": "git"}, {"lessThan": "46c8beeccd8ab2c863827254a85ea877654a3534", "status": "affected", "version": "33a5c2793451770cb6dcf0cc35c76cfd4b045513", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/hid/hid-letsketch.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"lessThan": "5.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.96", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.39", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: letsketch: fix UAF on inrange_timer at driver unbind\n\nletsketch_driver does not provide a .remove callback, but\nletsketch_probe() arms a per-device timer:\n\n timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0);\n\nThe timer is re-armed from letsketch_raw_event() with a 100 ms\ntimeout on every pen-in-range report, and its callback dereferences\ndata->input_tablet to deliver a synthetic BTN_TOOL_PEN release.\n\nletsketch_data is allocated with devm_kzalloc(), and its input_dev\nfields are devm-allocated via letsketch_setup_input_tablet(). On\ndevice unbind (USB unplug or rmmod), the HID core runs its default\nteardown and devm cleanup frees both letsketch_data and the input\ndevices. Because no .remove callback exists, nothing drains the\ntimer first: if raw_event armed it within ~100 ms of the unbind,\nthe pending timer fires on freed memory. This is a UAF read of\ndata and of data->input_tablet, followed by input_report_key() /\ninput_sync() into the freed input_dev.\n\nThe same problem can occur on the probe error path: if\nhid_hw_start() enabled I/O on an always-poll-quirk device and then\nfailed, raw_event may have armed the timer before devm releases\ndata.\n\nFix by adding a .remove callback that calls hid_hw_stop() first.\nhid_hw_stop() synchronously kills the URBs that deliver raw_event(),\nso once it returns no path can re-arm the timer. timer_shutdown_sync()\nthen drains any in-flight callback and permanently disables further\nmod_timer() calls. Apply the same timer_shutdown_sync() in the probe\nerror path so the timer is guaranteed not to outlive data."}], "id": "CVE-2026-64365", "lastModified": "2026-08-11T15:01:50.637", "metrics": {}, "published": "2026-07-25T10:17:19.280", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/17f5928d7010bc9e002930326b59e60e40c09ee3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2bb6e7143cf70ed281822d26c1848b2897ac36e9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3eca1a8165b5e7996e699e9df76cb4645e184d42"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/46c8beeccd8ab2c863827254a85ea877654a3534"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/523db788c0f84612707638e266e8957ca7e3a756"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/df3d8aa1a9392da3de66398e7a03422463806b21"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: HID: letsketch: fix UAF on inrange_timer at driver unbind", "id": "2507240", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507240"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's `letsketch` Human Interface Device (HID) driver. This vulnerability, a Use-After-Free (UAF), occurs because a timer is not properly shut down when the device is removed or during an error in its setup. This can cause the system to attempt to access memory that has already been released, leading to system instability, crashes, or potentially allowing an attacker to execute malicious code."], "name": "CVE-2026-64365", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64365\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64365\nhttps://lore.kernel.org/linux-cve-announce/2026072521-CVE-2026-64365-6535@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[33a5c2793451770cb6dcf0cc35c76cfd4b045513,2bb6e7143cf70ed281822d26c1848b2897ac36e9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[33a5c2793451770cb6dcf0cc35c76cfd4b045513,523db788c0f84612707638e266e8957ca7e3a756)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[33a5c2793451770cb6dcf0cc35c76cfd4b045513,17f5928d7010bc9e002930326b59e60e40c09ee3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[33a5c2793451770cb6dcf0cc35c76cfd4b045513,3eca1a8165b5e7996e699e9df76cb4645e184d42)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[33a5c2793451770cb6dcf0cc35c76cfd4b045513,df3d8aa1a9392da3de66398e7a03422463806b21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[33a5c2793451770cb6dcf0cc35c76cfd4b045513,46c8beeccd8ab2c863827254a85ea877654a3534)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.96,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.39,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.4,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-25T15:00:04.041783+00:00", "updated": "2026-08-02T13:15:03.571943+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}