Use-after-free in Linux kernel - CVE-2026-64365
Published: July 27, 2026
Vulnerability identifier: #VU139600
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64365
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker with physical access to cause a use-after-free condition.
The vulnerability exists due to use-after-free in the letsketch HID driver inrange_timer handling when unbinding the device or during the probe error path after raw events arm the timer. An attacker with physical access can trigger device removal or induce the vulnerable cleanup sequence to cause a use-after-free condition.
The issue can be triggered by USB unplug or module removal, and also on the probe error path if I/O has already been enabled and the timer was armed before cleanup.
Affected software
Linux kernel
How to mitigate CVE-2026-64365
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/17f5928d7010bc9e002930326b59e60e40c09ee3
- https://git.kernel.org/stable/c/2bb6e7143cf70ed281822d26c1848b2897ac36e9
- https://git.kernel.org/stable/c/3eca1a8165b5e7996e699e9df76cb4645e184d42
- https://git.kernel.org/stable/c/46c8beeccd8ab2c863827254a85ea877654a3534
- https://git.kernel.org/stable/c/523db788c0f84612707638e266e8957ca7e3a756
- https://git.kernel.org/stable/c/df3d8aa1a9392da3de66398e7a03422463806b21