CVE-2026-68091

A flaw was found in the Linux kernel's HID Wacom driver. When the wacom_parse_and_register() function encounters failures after starting the Human Interface Device (HID) hardware, its error handling path releases Wacom resources without properly stopping the HID hardware. This improper resource management could lead to system instability or a denial of service (DoS) condition.

A Wacom HID device probe can fail after hid_hw_start() has already started the HID hardware, while later error paths release Wacom driver resources without stopping the hardware first. This can leave callbacks or device activity running against resources that are being torn down, which is primarily a local or physical denial of service risk and a possible lifetime bug candidate. For the CVSS the PR:N is used in the paranoid score because a malicious or faulty HID device can trigger the probe error path without a local user account on the target. The issue is not network reachable and normally requires physical device access or an equivalent virtual HID path. Impact is at least denial of service via kernel crash or unstable device state, with limited confidentiality or integrity impact only in the paranoid interpretation due to possible use-after-free style lifetime exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.