CVE-2026-68091HID: wacom: stop hardware after post-start probe failures
- 8.8HighCVSS base score
- 0.26%Exploitation in 30 daysEPSS · top 82% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: stop hardware after post-start probe failures wacom_parse_and_register() starts HID hardware before registering inputs and initializing pad LEDs/remotes. Those later steps can fail, but their error paths currently release Wacom resources without stopping the HID hardware. Route post-hid_hw_start() failures through hid_hw_stop() before releasing driver resources. This issue was identified during our ongoing static-analysis research while reviewing kernel code.
Timeline
ID reserved
By Linux
- 11 days later
· 11 days later
Published
- 2 months later
· 2 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.26% · top 82% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Affected products
- affected f304eb483393f135ab479d02da6f5dc7d9b51cd6 – < 5a7ca028facf04921b2c1c2e4d1ee7f282510555
- affected 853307924a9003b3142b5253b1caa6625fbad9fc – < 3e6473a4f0596182acdda5219b4bebfbee76514f
- affected e5c6c8ef3e4d3a88407404daafbf2c6be62f2185 – < 46d8b8c85ae0589fb85746a64e8908160e52aac3
- affected fc41101a94b11cd0d5ad8e213b2b6965f248d653 – < 1a1ebdcb56ae58a0ee2c54dd15d75121e30424e3
- affected c1d6708bf0d3dd976460d435373cf5abf21ce258 – < 75eb2173b63ab41c24d80cd641af18f3c117a267
- affected c1d6708bf0d3dd976460d435373cf5abf21ce258 – < 416095e9a6037b4b39fcadd0d2bd77a8852211ec
- affected c1d6708bf0d3dd976460d435373cf5abf21ce258 – < e2cc711a9df37f359159b21db56cea9c21f58a9c
- affected c1d6708bf0d3dd976460d435373cf5abf21ce258 – < ec2612b8ad9e642596db011dd8b6568ef1edeaa1
- affected d943536197c1a05e377452af4ec7942e11d018f4
- affected dbaca8fa9ec2c5aa55ec515686ce3b9007554eab
- affected 79187e8099a9feb550916dbfb962497522022b6d
- affected 5.10.210 – < 5.10.261
- affected 5.15.149 – < 5.15.212
- affected 6.1.79 – < 6.1.178
- affected 6.6.18 – < 6.6.145
- affected 4.19.307 – < 4.20
- affected 5.4.269 – < 5.5
- affected 6.7.6 – < 6.8
- affected 6.8
- unaffected < 6.8
- unaffected 5.10.261 – ≤ 5.10.*
- unaffected 5.15.212 – ≤ 5.15.*
- unaffected 6.1.178 – ≤ 6.1.*
- unaffected 6.6.145 – ≤ 6.6.*
- unaffected 6.12.96 – ≤ 6.12.*
- unaffected 6.18.39 – ≤ 6.18.*
- unaffected 7.1.4 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References8
- https://git.kernel.org/stable/c/5a7ca028facf04921b2c1c2e4d1ee7f282510555 (opens in a new tab)
- https://git.kernel.org/stable/c/3e6473a4f0596182acdda5219b4bebfbee76514f (opens in a new tab)
- https://git.kernel.org/stable/c/46d8b8c85ae0589fb85746a64e8908160e52aac3 (opens in a new tab)
- https://git.kernel.org/stable/c/1a1ebdcb56ae58a0ee2c54dd15d75121e30424e3 (opens in a new tab)
- https://git.kernel.org/stable/c/75eb2173b63ab41c24d80cd641af18f3c117a267 (opens in a new tab)
- https://git.kernel.org/stable/c/416095e9a6037b4b39fcadd0d2bd77a8852211ec (opens in a new tab)
- https://git.kernel.org/stable/c/e2cc711a9df37f359159b21db56cea9c21f58a9c (opens in a new tab)
- https://git.kernel.org/stable/c/ec2612b8ad9e642596db011dd8b6568ef1edeaa1 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-55272 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-68091)Record last updated .