{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-68091", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.367Z", "datePublished": "2026-08-10T11:51:46.683Z", "dateUpdated": "2026-08-17T04:58:39.275Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:58:39.275Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: stop hardware after post-start probe failures\n\nwacom_parse_and_register() starts HID hardware before registering inputs\nand initializing pad LEDs/remotes. Those later steps can fail, but their\nerror paths currently release Wacom resources without stopping the HID\nhardware.\n\nRoute post-hid_hw_start() failures through hid_hw_stop() before\nreleasing driver resources.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The flaw is in the Wacom HID driver probe path reached when a Wacom-class HID device is connected; Bluetooth Wacom tablets are widely deployed and let an adjacent attacker deliver crafted HID traffic without USB port access.\nAC:L - A malicious or fuzzed Wacom HID device can steer probe through post-hid_hw_start() failure paths and the scheduled init_work, reliably leaving HID hardware active after driver teardown.\nPR:N - Exploitation requires only presenting a rogue Wacom HID device over Bluetooth or USB; no prior local account, capability, or namespace privilege on the victim host is needed.\nUI:N - No victim interaction is required beyond the attacker initiating device connection; probe failure and continued HID activity occur automatically on the kernel hotplug path.\nS:U - Impact is kernel memory corruption and privilege escalation within the host kernel, not crossing a VM, container, or IOMMU security boundary.\nC:H - Continued HID callbacks and delayed work after wacom_release_resources() create a use-after-free on freed driver allocations, enabling arbitrary kernel memory disclosure.\nI:H - The dangling hardware/workqueue activity against freed Wacom state is a heap use-after-free that can be leveraged for arbitrary kernel writes and code execution.\nA:H - Accessing freed probe resources from still-running HID hardware or init_work can cause kernel oops, panic, or hang, producing complete system denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/hid/wacom_sys.c" ], "versions": [ { "version": "f304eb483393f135ab479d02da6f5dc7d9b51cd6", "lessThan": "5a7ca028facf04921b2c1c2e4d1ee7f282510555", "status": "affected", "versionType": "git" }, { "version": "853307924a9003b3142b5253b1caa6625fbad9fc", "lessThan": "3e6473a4f0596182acdda5219b4bebfbee76514f", "status": "affected", "versionType": "git" }, { "version": "e5c6c8ef3e4d3a88407404daafbf2c6be62f2185", "lessThan": "46d8b8c85ae0589fb85746a64e8908160e52aac3", "status": "affected", "versionType": "git" }, { "version": "fc41101a94b11cd0d5ad8e213b2b6965f248d653", "lessThan": "1a1ebdcb56ae58a0ee2c54dd15d75121e30424e3", "status": "affected", "versionType": "git" }, { "version": "c1d6708bf0d3dd976460d435373cf5abf21ce258", "lessThan": "75eb2173b63ab41c24d80cd641af18f3c117a267", "status": "affected", "versionType": "git" }, { "version": "c1d6708bf0d3dd976460d435373cf5abf21ce258", "lessThan": "416095e9a6037b4b39fcadd0d2bd77a8852211ec", "status": "affected", "versionType": "git" }, { "version": "c1d6708bf0d3dd976460d435373cf5abf21ce258", "lessThan": "e2cc711a9df37f359159b21db56cea9c21f58a9c", "status": "affected", "versionType": "git" }, { "version": "c1d6708bf0d3dd976460d435373cf5abf21ce258", "lessThan": "ec2612b8ad9e642596db011dd8b6568ef1edeaa1", "status": "affected", "versionType": "git" }, { "version": "d943536197c1a05e377452af4ec7942e11d018f4", "status": "affected", "versionType": "git" }, { "version": "dbaca8fa9ec2c5aa55ec515686ce3b9007554eab", "status": "affected", "versionType": "git" }, { "version": "79187e8099a9feb550916dbfb962497522022b6d", "status": "affected", "versionType": "git" }, { "version": "5.10.210", "lessThan": "5.10.261", "status": "affected", "versionType": "semver" }, { "version": "5.15.149", "lessThan": "5.15.212", "status": "affected", "versionType": "semver" }, { "version": "6.1.79", "lessThan": "6.1.178", "status": "affected", "versionType": "semver" }, { "version": "6.6.18", "lessThan": "6.6.145", "status": "affected", "versionType": "semver" }, { "version": "4.19.307", "lessThan": "4.20", "status": "affected", "versionType": "semver" }, { "version": "5.4.269", "lessThan": "5.5", "status": "affected", "versionType": "semver" }, { "version": "6.7.6", "lessThan": "6.8", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/hid/wacom_sys.c" ], "versions": [ { "version": "6.8", "status": "affected" }, { "version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.210", "versionEndExcluding": "5.10.261" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.149", "versionEndExcluding": "5.15.212" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.79", "versionEndExcluding": "6.1.178" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.18", "versionEndExcluding": "6.6.145" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.96" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.39" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.1.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.307" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.269" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.6" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5a7ca028facf04921b2c1c2e4d1ee7f282510555" }, { "url": "https://git.kernel.org/stable/c/3e6473a4f0596182acdda5219b4bebfbee76514f" }, { "url": "https://git.kernel.org/stable/c/46d8b8c85ae0589fb85746a64e8908160e52aac3" }, { "url": "https://git.kernel.org/stable/c/1a1ebdcb56ae58a0ee2c54dd15d75121e30424e3" }, { "url": "https://git.kernel.org/stable/c/75eb2173b63ab41c24d80cd641af18f3c117a267" }, { "url": "https://git.kernel.org/stable/c/416095e9a6037b4b39fcadd0d2bd77a8852211ec" }, { "url": "https://git.kernel.org/stable/c/e2cc711a9df37f359159b21db56cea9c21f58a9c" }, { "url": "https://git.kernel.org/stable/c/ec2612b8ad9e642596db011dd8b6568ef1edeaa1" } ], "title": "HID: wacom: stop hardware after post-start probe failures", "x_generator": { "engine": "bippy-1.2.0" } } } }