The letsketch HID driver in the Linux kernel had a use-after-free vulnerability due to the absence of a .remove callback. The driver arms a per-device timer that is re-armed on pen-in-range events. On device unbind or removal, the HID core frees the associated data and input devices without stopping the timer, allowing the timer callback to access freed memory. This leads to a UAF read of the letsketch_data structure and its input_tablet field, followed by calls to input_report_key() and input_sync() on freed input device memory. The vulnerability also affects the probe error path where the timer may be armed before failure cleanup. The patch adds a .remove callback that calls hid_hw_stop() to synchronously kill URBs and prevent the timer from being re-armed, followed by timer_shutdown_sync() to drain any pending timer callbacks.

This vulnerability allows a use-after-free condition in kernel memory, which can lead to undefined behavior including potential kernel crashes or memory corruption. The impact is limited to the letsketch HID driver and involves kernel memory safety violations triggered by device unbind or probe error conditions. There are no known exploits in the wild.

A fix has been implemented by adding a .remove callback that stops the hardware and synchronously drains the timer to prevent use-after-free. Users should update to a Linux kernel version that includes this patch. Since this is a kernel driver vulnerability, applying the official kernel update or patch is the recommended remediation. Patch status is not explicitly confirmed here; check the vendor or Linux kernel advisory for the specific fixed version and apply updates accordingly.