CVE-2026-68091
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In the Linux kernel, the Wacom HID driver has an issue where after starting HID hardware, but before registering input devices and initializing LEDs, failures can occur. In such cases, driver resources are released without stopping the HID hardware, potentially leading to an incorrect state. The fix routes post-start failures through hid_hw_stop() before releasing resources.
Risk Assessment
Failure to stop HID hardware after an error may lead to improper operation of Wacom devices or the system, potentially causing instability or crashes.
Recommendation
It is recommended to update the Linux kernel to a version containing the fix that ensures HID hardware is stopped in case of post-start failures.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: stop hardware after post-start probe failures wacom_parse_and_register() starts HID hardware before registering inputs and initializing pad LEDs/remotes. Those later steps can fail, but their error paths currently release Wacom resources without stopping the HID hardware. Route post-hid_hw_start() failures through hid_hw_stop() before releasing driver resources. This issue was identified during our ongoing static-analysis research while reviewing kernel code.