CVE-2026-64365 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
HID: letsketch: fix UAF on inrange_timer at driver unbind
letsketch_driver does not provide a .remove callback, but letsketch_probe() arms a per-device timer:
timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0);
The timer is re-armed from letsketch_raw_event() with a 100 ms timeout on every pen-in-range report, and its callback dereferences data->input_tablet to deliver a synthetic BTN_TOOL_PEN release.
letsketch_data is allocated with devm_kzalloc(), and its input_dev fields are devm-allocated via letsketch_setup_input_tablet(). On device unbind (USB unplug or rmmod), the HID core runs its default teardown and devm cleanup frees both letsketch_data and the input devices. Because no .remove callback exists, nothing drains the timer first: if raw_event armed it within ~100 ms of the unbind, the pending timer fires on freed memory. This is a UAF read of data and of data->input_tablet, followed by input_report_key() / input_sync() into the freed input_dev.
The same problem can occur on the probe error path: if hid_hw_start() enabled I/O on an always-poll-quirk device and then failed, raw_event may have armed the timer before devm releases data.
Fix by adding a .remove callback that calls hid_hw_stop() first. hid_hw_stop() synchronously kills the URBs that deliver raw_event(), so once it returns no path can re-arm the timer. timer_shutdown_sync() then drains any in-flight callback and permanently disables further mod_timer() calls. Apply the same timer_shutdown_sync() in the probe error path so the timer is guaranteed not to outlive data.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability described represents a use-after-free condition in the Linux kernel's HID subsystem, specifically within the letsketch driver implementation. This issue arises from improper handling of device lifecycle management and timer synchronization during driver unbinding operations. The flaw occurs when a USB tablet device using the letsketch driver is disconnected or removed from the system while pending timer events may still be scheduled. The root cause lies in the driver's absence of a proper remove callback, which creates a temporal race condition between device teardown and asynchronous timer execution.
The technical implementation details reveal that the letsketch_driver fails to register a .remove callback function, despite having allocated per-device memory structures including a timer setup via timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0). During normal operation, the letsketch_raw_event() function re-arms this timer with a 100 millisecond timeout on every pen-in-range report, creating a continuous scheduling loop. The timer callback function letsketch_inrange_timeout directly dereferences data->input_tablet to generate synthetic input events, specifically BTN_TOOL_PEN release notifications. This design pattern creates a dangerous dependency where the timer's execution path references memory that may have been freed during device removal operations.
The operational impact of this vulnerability manifests as a use-after-free read condition on both the letsketch_data structure and its embedded input_tablet field. When a device is unbound through USB unplugging or module removal, the HID core performs default cleanup procedures that automatically free all devm-allocated memory including both the letsketch_data structure and associated input devices. However, because no .remove callback exists to gracefully shut down pending timer operations, any timer that was armed within approximately 100 milliseconds of unbind will execute against freed memory locations. This results in memory corruption and potential privilege escalation opportunities as the system attempts to deliver input events to deallocated device structures.
The vulnerability also extends to error handling paths during driver probe operations, where similar race conditions can occur. If hid_hw_start() successfully enables I/O operations on a device with an always-poll-quirk configuration and subsequently fails due to other initialization problems, the timer may have been armed before cleanup operations begin. This creates additional attack vectors where memory corruption can occur even during normal driver loading sequences rather than just unloading scenarios.
The proposed fix implements proper device lifecycle management by introducing a .remove callback that first calls hid_hw_stop() to synchronously terminate all pending URBs and prevent further timer re-arming operations. The subsequent timer_shutdown_sync() call ensures complete drainage of any in-flight timer callbacks while permanently disabling future modifications to the timer state. This approach directly addresses the timing issues identified in both normal unbind scenarios and error path conditions, providing comprehensive protection against use-after-free vulnerabilities. The solution aligns with established security practices for kernel driver development and follows industry standards for memory safety and resource management.
This vulnerability type maps to CWE-416 Use After Free, which specifically addresses improper handling of memory resources after they have been freed. The implementation pattern also relates to ATT&CK technique T1068 Exploitation for Privilege Escalation, as use-after-free conditions in kernel space can lead to arbitrary code execution and privilege escalation. The fix demonstrates proper resource management principles that should be applied across all kernel drivers handling asynchronous timer operations and device lifecycle events, making it a critical security enhancement for the Linux HID subsystem and similar driver frameworks.