CVE-2026-64365

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the HID letsketch driver. The letsketch probe() function initializes a per-device timer inrange timer using timer setup(), which is subsequently re-armed by letsketch raw event(). Because the letsketch driver lacks a .remove callback, the timer is not drained during device unbind (such as USB unplugging or module removal) or during certain probe error paths. Consequently, if the timer fires after the letsketch data and associated input devices have been freed by the system, it leads to a UAF read of data and data->input tablet, followed by calls to input report key() and input sync() on the freed input dev memory. Use-After-Free is a condition where a program continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution.

Recommendations Implement a .remove callback that invokes hid hw stop() to kill URBs and timer shutdown sync() to drain pending callbacks and disable the timer. Apply timer shutdown sync() within the probe error path to ensure the timer does not outlive the allocated data.