The Linux kernel's HID letsketch driver had a use-after-free vulnerability (CVE-2026-64365) caused by the absence of a .remove callback to drain a per-device timer (inrange_timer). The timer is armed during device operation and can fire after the device is unbound and its memory freed, leading to a UAF read and potential further impact. The letsketch_data structure and its input devices are devm-allocated and freed automatically on unbind, but the timer is not canceled, causing the vulnerability. This flaw was resolved in Linux kernel versions 7.0.0-31.31 and later. The vulnerability has a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a high severity local attack requiring low privileges and no user interaction. The vendor advisory from Ubuntu confirms the availability of patches and advises updating to fixed kernel versions.

Successful exploitation of this vulnerability could allow a local attacker with low privileges to cause a use-after-free condition, potentially leading to arbitrary code execution, privilege escalation, or system compromise. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability. However, exploitation requires local access and the ability to trigger the timer within a short window during device unbind.

A patch is available and has been released by the vendor. Users should update their Linux kernel to version 7.0.0-31.31 or later (including the specified patched builds) to remediate this vulnerability. After updating, a system reboot is required to apply the fix. No additional mitigation steps are necessary as the issue is resolved by the official patch.