Skip to main content

Linux Kernel CVE-2026-68091

| EUVDEUVD-2026-55272 HIGH
2026-08-10 Linux GHSA-jmfj-p2w9-43g4
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

AV:A for Bluetooth/USB-adjacent access; AC:H because triggering probe failure requires a malformed or emulated Wacom device, not a trivial condition; C/I/A:H reflects kernel memory corruption potential.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.4 MEDIUM
AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:11 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
8.8 (HIGH)
Patch available
Aug 10, 2026 - 13:03 EUVD
CVE Published
Aug 10, 2026 - 11:51 cve.org
HIGH 8.8
CVE Published
Aug 10, 2026 - 11:51 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: stop hardware after post-start probe failures

wacom_parse_and_register() starts HID hardware before registering inputs and initializing pad LEDs/remotes. Those later steps can fail, but their error paths currently release Wacom resources without stopping the HID hardware.

Route post-hid_hw_start() failures through hid_hw_stop() before releasing driver resources.

This issue was identified during our ongoing static-analysis research while reviewing kernel code.

AnalysisAI

Resource mismanagement in the Linux kernel Wacom HID driver leaves hardware running after failed initialization, creating a potential use-after-free condition in kernel memory. Affects a broad range of stable Linux kernel branches from 4.19 through 6.8, requiring a Wacom HID device and a specific probe failure to trigger. Despite a CVSS score of 8.8, EPSS sits at 0.18% (7th percentile) and no public exploit exists; the vulnerability was discovered via static analysis, not active exploitation.

Technical ContextAI

The Linux kernel HID subsystem includes the Wacom driver (drivers/hid/wacom_sys.c), where wacom_parse_and_register() orchestrates device bring-up: it calls hid_hw_start() to begin hardware operation, then registers input devices and initializes pad LEDs and remote functionality. When those post-start steps fail, their error paths free Wacom-allocated driver resources (via kfree and related teardown) without first invoking hid_hw_stop(). This means the HID hardware remains active and may generate events or callbacks referencing memory that has already been returned to the kernel allocator - a classic use-after-free pattern. No CWE was assigned in the NVD entry, but the root cause maps to CWE-672 (Operation on a Resource after Expiration or Release) or CWE-416 (Use After Free). The CPE identifier cpe:2.3:a:linux:linux covers the full range of affected mainline and stable kernel versions.

RemediationAI

Apply the upstream stable kernel patches for your branch: commit 5a7ca028facf04921b2c1c2e4d1ee7f282510555, 3e6473a4f0596182acdda5219b4bebfbee76514f, 46d8b8c85ae0589fb85746a64e8908160e52aac3, 1a1ebdcb56ae58a0ee2c54dd15d75121e30424e3, 75eb2173b63ab41c24d80cd641af18f3c117a267, 416095e9a6037b4b39fcadd0d2bd77a8852211ec, e2cc711a9df37f359159b21db56cea9c21f58a9c, and ec2612b8ad9e642596db011dd8b6568ef1edeaa1 (all at https://git.kernel.org/stable). Target patched releases by branch: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.18.39, 7.1.4, and 7.2-rc1 or later. Distributions (Debian, Ubuntu, RHEL, SUSE) should deliver these fixes through standard kernel update channels. As a compensating control where patching is delayed, the Wacom kernel module can be disabled with modprobe -r wacom and blacklisted via echo 'blacklist wacom' >> /etc/modprobe.d/wacom-blacklist.conf - this eliminates the vulnerable code path entirely at the cost of losing all Wacom tablet functionality. Systems with no Wacom device attached are not exposed to this code path and require no immediate action.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68091 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy