CVE Explorer

CVE-2026-64365

In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrange_timer at driver unbind letsketch_driver does not provide a .remove callback, but letsketch_probe() arms a per-device timer: timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0); The timer is re-armed from letsketch_raw_event() with a 100 ms timeout on every pen-in-range report, and its callback dereferences data->input_tablet to deliver a synthetic BTN_TOOL_PEN release. lets

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:e4ff04cc1bf224000d2cc91f5a104e0b42116df668818935d65d82859845284d

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-letsketch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.17"},{"lessThan":"5.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"less…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:eb524eefb2ec2dbe02b6a48b9edc832978e67215a819fd54d21d17c05f8fd12d · sha256:641dbcc8d0b8a7e2… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-letsketch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2bb6e7143cf70ed281822d26c1848b2897ac36e9","status":"affected","version":"33a5c2793451770cb6dcf0cc35c76cfd4b045513","versionType":"git"},{"lessThan":"523db788c0f84612707638e266e8957ca7e3a756","status":"affected","version":"33a5c2793451770cb6dcf0cc35c76cfd4b045513","versionType":"git"},{"lessThan":"17f5928d7010bc9e002930326b59e60e40c09ee3","status":"affected","version":"33a5c2793451770cb6…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:eb524eefb2ec2dbe02b6a48b9edc832978e67215a819fd54d21d17c05f8fd12d · sha256:641dbcc8d0b8a7e2… · /containers/cna/affected/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:eb524eefb2ec2dbe02b6a48b9edc832978e67215a819fd54d21d17c05f8fd12d · sha256:641dbcc8d0b8a7e2… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:eb524eefb2ec2dbe02b6a48b9edc832978e67215a819fd54d21d17c05f8fd12d · sha256:641dbcc8d0b8a7e2… · /containers/cna/affected/0

Source references

6 source assertions

{"url":"https://git.kernel.org/stable/c/17f5928d7010bc9e002930326b59e60e40c09ee3"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:eb524eefb2ec2dbe02b6a48b9edc832978e67215a819fd54d21d17c05f8fd12d · sha256:641dbcc8d0b8a7e2… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/2bb6e7143cf70ed281822d26c1848b2897ac36e9"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:eb524eefb2ec2dbe02b6a48b9edc832978e67215a819fd54d21d17c05f8fd12d · sha256:641dbcc8d0b8a7e2… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/3eca1a8165b5e7996e699e9df76cb4645e184d42"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:eb524eefb2ec2dbe02b6a48b9edc832978e67215a819fd54d21d17c05f8fd12d · sha256:641dbcc8d0b8a7e2… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/46c8beeccd8ab2c863827254a85ea877654a3534"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:eb524eefb2ec2dbe02b6a48b9edc832978e67215a819fd54d21d17c05f8fd12d · sha256:641dbcc8d0b8a7e2… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/523db788c0f84612707638e266e8957ca7e3a756"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:eb524eefb2ec2dbe02b6a48b9edc832978e67215a819fd54d21d17c05f8fd12d · sha256:641dbcc8d0b8a7e2… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/df3d8aa1a9392da3de66398e7a03422463806b21"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:eb524eefb2ec2dbe02b6a48b9edc832978e67215a819fd54d21d17c05f8fd12d · sha256:641dbcc8d0b8a7e2… · /containers/cna/references/4

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer