Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-64365— HID: letsketch: fix UAF on inrange_timer at driver unbind

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于HID letsketch驱动在设备卸载时未提供remove回调函数，导致定时器在释放后触发，造成释放后重用（UAF），可能被利用读取已释放内存或导致系统崩溃。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.17% · P7

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux 33a5c2793451770cb6dcf0cc35c76cfd4b045513< 2bb6e7143cf70ed281822d26c1848b2897ac36e9 affected
33a5c2793451770cb6dcf0cc35c76cfd4b045513< 523db788c0f84612707638e266e8957ca7e3a756 affected
33a5c2793451770cb6dcf0cc35c76cfd4b045513< 17f5928d7010bc9e002930326b59e60e40c09ee3 affected
33a5c2793451770cb6dcf0cc35c76cfd4b045513< 3eca1a8165b5e7996e699e9df76cb4645e184d42 affected
33a5c2793451770cb6dcf0cc35c76cfd4b045513< df3d8aa1a9392da3de66398e7a03422463806b21 affected
33a5c2793451770cb6dcf0cc35c76cfd4b045513< 46c8beeccd8ab2c863827254a85ea877654a3534 affected
5.17 affected
< 5.17 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64365

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HID: letsketch: fix UAF on inrange_timer at driver unbind
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrange_timer at driver unbind letsketch_driver does not provide a .remove callback, but letsketch_probe() arms a per-device timer: timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0); The timer is re-armed from letsketch_raw_event() with a 100 ms timeout on every pen-in-range report, and its callback dereferences data->input_tablet to deliver a synthetic BTN_TOOL_PEN release. letsketch_data is allocated with devm_kzalloc(), and its input_dev fields are devm-allocated via letsketch_setup_input_tablet(). On device unbind (USB unplug or rmmod), the HID core runs its default teardown and devm cleanup frees both letsketch_data and the input devices. Because no .remove callback exists, nothing drains the timer first: if raw_event armed it within ~100 ms of the unbind, the pending timer fires on freed memory. This is a UAF read of data and of data->input_tablet, followed by input_report_key() / input_sync() into the freed input_dev. The same problem can occur on the probe error path: if hid_hw_start() enabled I/O on an always-poll-quirk device and then failed, raw_event may have armed the timer before devm releases data. Fix by adding a .remove callback that calls hid_hw_stop() first. hid_hw_stop() synchronously kills the URBs that deliver raw_event(), so once it returns no path can re-arm the timer. timer_shutdown_sync() then drains any in-flight callback and permanently disables further mod_timer() calls. Apply the same timer_shutdown_sync() in the probe error path so the timer is guaranteed not to outlive data.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于HID letsketch驱动在设备卸载时未提供remove回调函数，导致定时器在释放后触发，造成释放后重用（UAF），可能被利用读取已释放内存或导致系统崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 33a5c2793451770cb6dcf0cc35c76cfd4b045513 ~ 2bb6e7143cf70ed281822d26c1848b2897ac36e9 -
Linux Linux 5.17 -

II. Public POCs for CVE-2026-64365

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64365

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64365 (5)

Same Patch Batch · Linux · 2026-07-25 · 274 CVEs total

CVE-2026-64355 9.8 CRITICAL bpf: Reject fragmented frames in devmap
CVE-2026-64459 9.8 CRITICAL tcp: restore RCU grace period in tcp_ao_destroy_sock
CVE-2026-64303 9.8 CRITICAL spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
CVE-2026-64439 9.8 CRITICAL crypto: krb5 - filter out async aead implementations at alloc
CVE-2026-64410 9.8 CRITICAL netfilter: flowtable: IPIP tunnel hardware offload is not yet support
CVE-2026-64399 9.8 CRITICAL ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
CVE-2026-64397 9.8 CRITICAL ksmbd: serialize QUERY_DIRECTORY requests per file
CVE-2026-64391 9.8 CRITICAL ksmbd: use opener credentials for ADS I/O
CVE-2026-64387 9.8 CRITICAL smb: client: fix query directory replay double-free
CVE-2026-64386 9.8 CRITICAL smb: client: fix query_info() replay double-free
CVE-2026-64385 9.8 CRITICAL smb: client: fix double-free in SMB2_ioctl() replay
CVE-2026-64383 9.8 CRITICAL smb: client: fix double-free in SMB2_flush() replay
CVE-2026-64384 9.8 CRITICAL smb: client: fix change notify replay double-free
CVE-2026-64268 9.8 CRITICAL RDMA/siw: bound Read Response placement to the RREAD length
CVE-2026-64523 9.8 CRITICAL net/handshake: Take a long-lived file reference at submit
CVE-2026-64269 9.1 CRITICAL RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
CVE-2026-64257 9.1 CRITICAL smb: client: reject overlapping data areas in SMB2 responses
CVE-2026-64319 9.1 CRITICAL nvmet-auth: validate reply message payload bounds against transfer length
CVE-2026-64320 9.1 CRITICAL nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
CVE-2026-64393 9.1 CRITICAL ksmbd: run set info with opener credentials

Showing top 20 of 274 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64365

No comments yet

Leave a comment