CVE-2026-64365

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

HID: letsketch: fix UAF on inrange_timer at driver unbind

letsketch_driver does not provide a .remove callback, but

letsketch_probe() arms a per-device timer:

timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0);

The timer is re-armed from letsketch_raw_event() with a 100 ms

timeout on every pen-in-range report, and its callback dereferences

data->input_tablet to deliver a synthetic BTN_TOOL_PEN release.

letsketch_data is allocated with devm_kzalloc(), and its input_dev

fields are devm-allocated via letsketch_setup_input_tablet(). On

device unbind (USB unplug or rmmod), the HID core runs its default

teardown and devm cleanup frees both letsketch_data and the input

devices. Because no .remove callback exists, nothing drains the

timer first: if raw_event armed it within ~100 ms of the unbind,

the pending timer fires on freed memory. This is a UAF read of

data and of data->input_tablet, followed by

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References