CVE-2026-68091: Linux Kernel HID Wacom Hardware Flaw

CVE-2026-68091 Overview

CVE-2026-68091 is a Linux kernel vulnerability in the HID Wacom driver. The flaw resides in wacom_parse_and_register(), which starts HID hardware before registering inputs and initializing pad LEDs and remotes. When those later initialization steps fail, the existing error paths release Wacom driver resources without first stopping the HID hardware. This leaves the hardware in a running state while its backing resources are freed, creating a use-after-free class condition in the kernel. The issue was identified through static-analysis research of the kernel source tree.

Critical Impact
An adjacent-network attacker can trigger probe failures in the Wacom HID driver to reach a kernel state where hardware runs against freed driver resources, enabling potential code execution or denial of service.

Affected Products

Linux kernel HID subsystem (drivers/hid/wacom_sys.c)
Linux distributions shipping the affected wacom HID driver
Systems exposing Wacom HID device probe paths (USB and Bluetooth)

Discovery Timeline

2026-08-10 - CVE-2026-68091 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68091

Vulnerability Analysis

The vulnerability sits in the Wacom HID driver probe sequence. wacom_parse_and_register() calls hid_hw_start() early to bring up the HID transport. It then proceeds to register input devices and initialize pad LEDs and remote inputs. Any failure in these post-start steps jumps to error handling that frees Wacom-specific driver state.

The error paths omit a matching hid_hw_stop() call. The HID core therefore continues to route reports into a driver whose state has been torn down. The fix routes all post-hid_hw_start() failures through hid_hw_stop() before releasing driver resources, ensuring the hardware is quiesced before memory is freed.

Root Cause

The root cause is asymmetric resource management between initialization and teardown in the driver probe function. hid_hw_start() acquires a runtime resource that must be released with hid_hw_stop() on every failure path, but the Wacom probe function skips that release when later probe steps fail. This is a classic missing-cleanup pattern that produces use-after-free or double-fault conditions during device attach.

Attack Vector

The attack vector is adjacent network per the CVSS vector, consistent with HID transports such as Bluetooth. An attacker within Bluetooth range able to present a crafted or malfunctioning Wacom-compatible HID device can trigger the failing branches inside wacom_parse_and_register(). Because the flaw is reached during device probe with no user interaction, an attacker can force the vulnerable path simply by getting the device to attach. Exploitation targets kernel memory, so successful abuse can lead to kernel code execution or a kernel crash.

No public proof-of-concept code is available. Technical details are documented in the upstream fix commits, including Kernel Git Commit 1a1ebdc and Kernel Git Commit ec2612b8.

Detection Methods for CVE-2026-68091

Indicators of Compromise

Kernel Oops, BUG: or KASAN reports referencing wacom_parse_and_register, hid_hw_start, or wacom_sys.c in dmesg or journalctl -k output.
Unexpected kernel panics or module faults coinciding with Bluetooth or USB HID device connect events near workstations that use Wacom tablets.
Repeated failed Wacom device probes followed by driver unload or system instability.

Detection Strategies

Monitor kernel ring buffer telemetry for probe-time faults in the wacom and hid modules and correlate with device attach events over Bluetooth or USB.
Track running kernel versions across the Linux fleet and flag hosts still on pre-patch versions that expose Wacom HID transports.
Alert on new or unexpected Bluetooth HID pairings on endpoints outside of design and engineering user groups.

Monitoring Recommendations

Forward dmesg and auditd records into a centralized log platform and build rules for kernel exceptions in HID drivers.
Baseline expected HID device vendor and product IDs per host and alert on deviations.
Track kernel package versions with configuration management tooling to confirm patch adoption.

How to Mitigate CVE-2026-68091

Immediate Actions Required

Apply the vendor-provided kernel update that includes the upstream fix routing post-hid_hw_start() failures through hid_hw_stop().
Reboot affected systems after patching so the corrected wacom module is loaded.
Restrict Bluetooth HID pairing on endpoints that do not require Wacom devices.

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Relevant commits include Kernel Git Commit 1a1ebdc, Kernel Git Commit 3e6473a, Kernel Git Commit 416095e, Kernel Git Commit 46d8b8c, Kernel Git Commit 5a7ca02, Kernel Git Commit 75eb217, Kernel Git Commit e2cc711, and Kernel Git Commit ec2612b8. Track distribution advisories to align on the specific backported kernel package version for your environment.

Workarounds

Blacklist the wacom kernel module on systems that do not use Wacom hardware by adding blacklist wacom to a file under /etc/modprobe.d/.
Disable Bluetooth on endpoints that do not require it, using systemctl disable --now bluetooth.service.
Enforce USB and Bluetooth device allowlists at the endpoint policy layer to block untrusted HID devices from attaching.

bash

# Configuration example
# Prevent the vulnerable driver from loading until patched
echo 'blacklist wacom' | sudo tee /etc/modprobe.d/cve-2026-68091.conf
sudo update-initramfs -u

# Verify current kernel version and reboot after patch install
uname -r
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r)
sudo systemctl reboot