CVE-2026-64365: HID: letsketch: fix UAF on inrange_timer at driver unbind

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

HID: letsketch: fix UAF on inrange_timer at driver unbind

letsketch_driver does not provide a .remove callback, but
letsketch_probe() arms a per-device timer:

    timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0);

The timer is re-armed from letsketch_raw_event() with a 100 ms
timeout on every pen-in-range report, and its callback dereferences
data->input_tablet to deliver a synthetic BTN_TOOL_PEN release.

letsketch_data is allocated with devm_kzalloc(), and its input_dev
fields are devm-allocated via letsketch_setup_input_tablet().  On
device unbind (USB unplug or rmmod), the HID core runs its default
teardown and devm cleanup frees both letsketch_data and the input
devices.  Because no .remove callback exists, nothing drains the
timer first: if raw_event armed it within ~100 ms of the unbind,
the pending timer fires on freed memory.  This is a UAF read of
data and of data->input_tablet, followed by input_report_key() /
input_sync() into the freed input_dev.

The same problem can occur on the probe error path: if
hid_hw_start() enabled I/O on an always-poll-quirk device and then
failed, raw_event may have armed the timer before devm releases
data.

Fix by adding a .remove callback that calls hid_hw_stop() first.
hid_hw_stop() synchronously kills the URBs that deliver raw_event(),
so once it returns no path can re-arm the timer.  timer_shutdown_sync()
then drains any in-flight callback and permanently disables further
mod_timer() calls.  Apply the same timer_shutdown_sync() in the probe
error path so the timer is guaranteed not to outlive data.

The Linux kernel CVE team has assigned CVE-2026-64365 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.17 with commit 33a5c2793451770cb6dcf0cc35c76cfd4b045513 and fixed in 6.1.178 with commit 2bb6e7143cf70ed281822d26c1848b2897ac36e9
	Issue introduced in 5.17 with commit 33a5c2793451770cb6dcf0cc35c76cfd4b045513 and fixed in 6.6.145 with commit 523db788c0f84612707638e266e8957ca7e3a756
	Issue introduced in 5.17 with commit 33a5c2793451770cb6dcf0cc35c76cfd4b045513 and fixed in 6.12.96 with commit 17f5928d7010bc9e002930326b59e60e40c09ee3
	Issue introduced in 5.17 with commit 33a5c2793451770cb6dcf0cc35c76cfd4b045513 and fixed in 6.18.39 with commit 3eca1a8165b5e7996e699e9df76cb4645e184d42
	Issue introduced in 5.17 with commit 33a5c2793451770cb6dcf0cc35c76cfd4b045513 and fixed in 7.1.4 with commit df3d8aa1a9392da3de66398e7a03422463806b21
	Issue introduced in 5.17 with commit 33a5c2793451770cb6dcf0cc35c76cfd4b045513 and fixed in 7.2-rc3 with commit 46c8beeccd8ab2c863827254a85ea877654a3534

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64365
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/hid/hid-letsketch.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/2bb6e7143cf70ed281822d26c1848b2897ac36e9
	https://git.kernel.org/stable/c/523db788c0f84612707638e266e8957ca7e3a756
	https://git.kernel.org/stable/c/17f5928d7010bc9e002930326b59e60e40c09ee3
	https://git.kernel.org/stable/c/3eca1a8165b5e7996e699e9df76cb4645e184d42
	https://git.kernel.org/stable/c/df3d8aa1a9392da3de66398e7a03422463806b21
	https://git.kernel.org/stable/c/46c8beeccd8ab2c863827254a85ea877654a3534