CVE-2026-68091HID: wacom: stop hardware after post-start probe failures
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: stop hardware after post-start probe failures wacom_parse_and_register() starts HID hardware before registering inputs and initializing pad LEDs/remotes. Those later steps can fail, but their error paths currently release Wacom resources without stopping the HID hardware. Route post-hid_hw_start() failures through hid_hw_stop() before releasing driver resources. This issue was identified during our ongoing static-analysis research while reviewing kernel code.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f304eb483393f135ab479d02da6f5dc7d9b51cd6 before 5a7ca028facf04921b2c1c2e4d1ee7f282510555; 853307924a9003b3142b5253b1caa6625fbad9fc builds before 3e6473a4f0596182acdda5219b4bebfbee76514f; from e5c6c8ef3e4d3a88407404daafbf2c6be62f2185 before 46d8b8c85ae0589fb85746a64e8908160e52aac3; from fc41101a94b11cd0d5ad8e213b2b6965f248d653 before 1a1ebdcb56ae58a0ee2c54dd15d75121e30424e3; from c1d6708bf0d3dd976460d435373cf5abf21ce258 before 75eb2173b63ab41c24d80cd641af18f3c117a267; from c1d6708bf0d3dd976460d435373cf5abf21ce258 before 416095e9a6037b4b39fcadd0d2bd77a8852211ec; from c1d6708bf0d3dd976460d435373cf5abf21ce258 before e2cc711a9df37f359159b21db56cea9c21f58a9c; from c1d6708bf0d3dd976460d435373cf5abf21ce258 before ec2612b8ad9e642596db011dd8b6568ef1edeaa1; and 10 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/5a7ca028facf04921b2c1c2e4d1ee7f282510555
- https://git.kernel.org/stable/c/3e6473a4f0596182acdda5219b4bebfbee76514f
- https://git.kernel.org/stable/c/46d8b8c85ae0589fb85746a64e8908160e52aac3
- https://git.kernel.org/stable/c/1a1ebdcb56ae58a0ee2c54dd15d75121e30424e3
- https://git.kernel.org/stable/c/75eb2173b63ab41c24d80cd641af18f3c117a267
- https://git.kernel.org/stable/c/416095e9a6037b4b39fcadd0d2bd77a8852211ec
- https://git.kernel.org/stable/c/e2cc711a9df37f359159b21db56cea9c21f58a9c
- https://git.kernel.org/stable/c/ec2612b8ad9e642596db011dd8b6568ef1edeaa1
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.