CVE-2026-64365

A flaw was found in the Linux kernel's letsketch Human Interface Device (HID) driver. This vulnerability, a Use-After-Free (UAF), occurs because a timer is not properly shut down when the device is removed or during an error in its setup. This can cause the system to attempt to access memory that has already been released, leading to system instability, crashes, or potentially allowing an attacker to execute malicious code.

A use after free can occur in the HID letsketch driver because inrange_timer may remain armed when the device is unbound and devm cleanup frees letsketch_data and the related input_dev objects. A malicious or faulty Letsketch compatible USB HID device can send pen in range reports that re arm the timer and then trigger a disconnect or unbind timing window, causing the timer callback to dereference freed data and call input_report_key or input_sync on a freed input device. For the CVSS the PR:N value is used for the paranoid physical device scenario because no host privileges are required once an attacker can present the HID device to the target, although UI:R is still required for device attachment. The issue is not network reachable. Impact is at least denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to use after free memory corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.