CVE-2026-64365: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64365 Overview

CVE-2026-64365 is a use-after-free vulnerability in the Linux kernel's HID letsketch driver. The flaw exists because letsketch_driver does not implement a .remove callback, while letsketch_probe() arms a per-device inrange_timer. When the device is unbound through USB unplug or rmmod, the devm cleanup path frees both letsketch_data and the input devices without first draining the pending timer. If raw_event re-armed the timer within roughly 100 ms of unbind, the callback fires against freed memory, producing a UAF read of data and data->input_tablet followed by input_report_key() and input_sync() into a freed input_dev.

Critical Impact
A local attacker with the ability to unbind or physically disconnect an affected HID tablet device can trigger a kernel use-after-free, leading to memory corruption or potential privilege escalation.

Affected Products

Linux kernel HID subsystem — letsketch driver
Linux stable kernel branches receiving the referenced backport commits
Systems using LetSketch-compatible USB HID tablet devices

Discovery Timeline

2026-07-25 - CVE-2026-64365 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64365

Vulnerability Analysis

The letsketch HID driver allocates its per-device state via devm_kzalloc() and registers input devices through devm-managed helpers in letsketch_setup_input_tablet(). During probe, the driver sets up a timer with timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0). Every pen-in-range report received by letsketch_raw_event() re-arms this timer with a 100 ms timeout, and the timer callback dereferences data->input_tablet to deliver a synthetic BTN_TOOL_PEN release.

Because the driver lacks a .remove callback, the HID core's default teardown runs, and the devm cleanup releases letsketch_data and the associated input devices without stopping the timer. Any timer armed shortly before unbind fires after the backing memory has been freed, producing a use-after-free.

Root Cause

The root cause is a lifecycle mismatch between a device-managed allocation and a self-armed kernel timer. The devm framework releases the driver's private data on unbind, but the pending inrange_timer is neither cancelled nor drained. No synchronization guarantees the timer callback observes a valid data pointer after driver detach.

Attack Vector

Exploitation requires local access to trigger a driver unbind on an affected LetSketch HID device. An attacker can unplug the USB device, invoke rmmod, or write to the sysfs unbind attribute after generating pen-in-range HID reports. The same window exists on the probe error path if hid_hw_start() enabled I/O on an always-poll-quirk device before failing, allowing raw_event to arm the timer before devm releases data. Successful triggering results in a kernel use-after-free that may be leveraged for memory corruption or privilege escalation depending on heap layout.

See the upstream fix in Linux Kernel Commit 17f5928 and its stable backports for technical details of the corrected teardown sequence.

Detection Methods for CVE-2026-64365

Indicators of Compromise

Kernel oops or panic traces referencing letsketch_inrange_timeout, input_report_key, or input_sync following a USB disconnect or rmmod hid-letsketch event.
KASAN reports flagging use-after-free reads inside the HID letsketch code path shortly after driver unbind.
Unexpected kernel warnings tied to timer callbacks executing against freed slab objects in dmesg.

Detection Strategies

Enable CONFIG_KASAN on test and staging kernels to surface the UAF during device unbind stress testing.
Monitor kernel logs for stack traces containing letsketch_ symbols paired with USB disconnect events.
Correlate udev remove events for LetSketch HID vendor and product identifiers with subsequent kernel error messages.

Monitoring Recommendations

Forward kernel and dmesg output to a centralized log platform and alert on oops or KASAN signatures involving HID drivers.
Track loaded kernel module versions across the fleet to identify hosts still running vulnerable hid-letsketch builds.
Audit systems where users can physically attach USB HID tablets and prioritize them for patching.

How to Mitigate CVE-2026-64365

Immediate Actions Required

Update to a Linux kernel version that includes the fix commits referenced by the stable tree, and reboot affected hosts.
If patching is not immediately possible, blacklist the hid-letsketch module on systems that do not require LetSketch tablet support.
Restrict physical and administrative access that would allow attaching or unbinding USB HID devices on sensitive systems.

Patch Information

The upstream fix adds a .remove callback that calls hid_hw_stop() first, synchronously killing the URBs delivering raw_event() so no code path can re-arm the timer. timer_shutdown_sync() then drains any in-flight callback and permanently disables further mod_timer() calls. The same timer_shutdown_sync() is applied on the probe error path to ensure the timer cannot outlive data. See the following backports: Linux Kernel Commit 17f5928, Linux Kernel Commit 2bb6e71, Linux Kernel Commit 3eca1a8, Linux Kernel Commit 46c8bee, Linux Kernel Commit 523db78, and Linux Kernel Commit df3d8aa.

Workarounds

Blacklist the vulnerable module by adding blacklist hid-letsketch to a file under /etc/modprobe.d/ and rebuilding the initramfs.
Use udev rules to prevent binding of LetSketch USB device identifiers on production hosts that do not need tablet input.
Limit CAP_SYS_MODULE and sysfs unbind privileges to a minimum set of administrative accounts.

bash

# Configuration example
# Prevent the vulnerable driver from loading
echo 'blacklist hid-letsketch' | sudo tee /etc/modprobe.d/blacklist-hid-letsketch.conf
sudo depmod -a
sudo update-initramfs -u

# Verify the module is not currently loaded
lsmod | grep hid_letsketch