PT-2026-64586 · Linux · Linux
CVE-2026-64365
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
HID: letsketch: fix UAF on inrange timer at driver unbind
letsketch driver does not provide a .remove callback, but
letsketch probe() arms a per-device timer:
timer setup(&data->inrange timer, letsketch inrange timeout, 0);
The timer is re-armed from letsketch raw event() with a 100 ms
timeout on every pen-in-range report, and its callback dereferences
data->input tablet to deliver a synthetic BTN TOOL PEN release.
letsketch data is allocated with devm kzalloc(), and its input dev
fields are devm-allocated via letsketch setup input tablet(). On
device unbind (USB unplug or rmmod), the HID core runs its default
teardown and devm cleanup frees both letsketch data and the input
devices. Because no .remove callback exists, nothing drains the
timer first: if raw event armed it within ~100 ms of the unbind,
the pending timer fires on freed memory. This is a UAF read of
data and of data->input tablet, followed by input report key() /
input sync() into the freed input dev.
The same problem can occur on the probe error path: if
hid hw start() enabled I/O on an always-poll-quirk device and then
failed, raw event may have armed the timer before devm releases
data.
Fix by adding a .remove callback that calls hid hw stop() first.
hid hw stop() synchronously kills the URBs that deliver raw event(),
so once it returns no path can re-arm the timer. timer shutdown sync()
then drains any in-flight callback and permanently disables further
mod timer() calls. Apply the same timer shutdown sync() in the probe
error path so the timer is guaranteed not to outlive data.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux