---
id: CVE-2026-68091
title: 'HID: wacom: stop hardware after post-start probe failures'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  HID: wacom: stop hardware after post-start probe failures

  wacom_parse_and_register() starts HID hardware before registering inputs
  and initializing pad LEDs/remotes. T…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f304eb483393f135ab479d02da6f5dc7d9b51cd6 <
    5a7ca028facf04921b2c1c2e4d1ee7f282510555
  - >-
    Linux >= 853307924a9003b3142b5253b1caa6625fbad9fc <
    3e6473a4f0596182acdda5219b4bebfbee76514f
  - >-
    Linux >= e5c6c8ef3e4d3a88407404daafbf2c6be62f2185 <
    46d8b8c85ae0589fb85746a64e8908160e52aac3
  - >-
    Linux >= fc41101a94b11cd0d5ad8e213b2b6965f248d653 <
    1a1ebdcb56ae58a0ee2c54dd15d75121e30424e3
  - >-
    Linux >= c1d6708bf0d3dd976460d435373cf5abf21ce258 <
    75eb2173b63ab41c24d80cd641af18f3c117a267
  - >-
    Linux >= c1d6708bf0d3dd976460d435373cf5abf21ce258 <
    416095e9a6037b4b39fcadd0d2bd77a8852211ec
  - >-
    Linux >= c1d6708bf0d3dd976460d435373cf5abf21ce258 <
    e2cc711a9df37f359159b21db56cea9c21f58a9c
  - >-
    Linux >= c1d6708bf0d3dd976460d435373cf5abf21ce258 <
    ec2612b8ad9e642596db011dd8b6568ef1edeaa1
  - Linux d943536197c1a05e377452af4ec7942e11d018f4
  - Linux dbaca8fa9ec2c5aa55ec515686ce3b9007554eab
  - Linux 79187e8099a9feb550916dbfb962497522022b6d
  - Linux >= 5.10.210 < 5.10.261
  - Linux >= 5.15.149 < 5.15.212
  - Linux >= 6.1.79 < 6.1.178
  - Linux >= 6.6.18 < 6.6.145
  - Linux >= 4.19.307 < 4.20
  - Linux >= 5.4.269 < 5.5
  - Linux >= 6.7.6 < 6.8
  - Linux 6.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:43:38.593019Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:52:56.003Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68091'
references:
  - url: 'https://git.kernel.org/stable/c/5a7ca028facf04921b2c1c2e4d1ee7f282510555'
  - url: 'https://git.kernel.org/stable/c/3e6473a4f0596182acdda5219b4bebfbee76514f'
  - url: 'https://git.kernel.org/stable/c/46d8b8c85ae0589fb85746a64e8908160e52aac3'
  - url: 'https://git.kernel.org/stable/c/1a1ebdcb56ae58a0ee2c54dd15d75121e30424e3'
  - url: 'https://git.kernel.org/stable/c/75eb2173b63ab41c24d80cd641af18f3c117a267'
  - url: 'https://git.kernel.org/stable/c/416095e9a6037b4b39fcadd0d2bd77a8852211ec'
  - url: 'https://git.kernel.org/stable/c/e2cc711a9df37f359159b21db56cea9c21f58a9c'
  - url: 'https://git.kernel.org/stable/c/ec2612b8ad9e642596db011dd8b6568ef1edeaa1'
tags:
  - cve.org
epss: 0.00262
epssPercentile: 0.16841
ingestedAt: '2026-10-16T17:24:46.838Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: stop hardware after post-start probe failures

wacom_parse_and_register() starts HID hardware before registering inputs
and initializing pad LEDs/remotes. Those later steps can fail, but their
error paths currently release Wacom resources without stopping the HID
hardware.

Route post-hid_hw_start() failures through hid_hw_stop() before
releasing driver resources.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

## Affected

- `Linux >= f304eb483393f135ab479d02da6f5dc7d9b51cd6 < 5a7ca028facf04921b2c1c2e4d1ee7f282510555`
- `Linux >= 853307924a9003b3142b5253b1caa6625fbad9fc < 3e6473a4f0596182acdda5219b4bebfbee76514f`
- `Linux >= e5c6c8ef3e4d3a88407404daafbf2c6be62f2185 < 46d8b8c85ae0589fb85746a64e8908160e52aac3`
- `Linux >= fc41101a94b11cd0d5ad8e213b2b6965f248d653 < 1a1ebdcb56ae58a0ee2c54dd15d75121e30424e3`
- `Linux >= c1d6708bf0d3dd976460d435373cf5abf21ce258 < 75eb2173b63ab41c24d80cd641af18f3c117a267`
- `Linux >= c1d6708bf0d3dd976460d435373cf5abf21ce258 < 416095e9a6037b4b39fcadd0d2bd77a8852211ec`
- `Linux >= c1d6708bf0d3dd976460d435373cf5abf21ce258 < e2cc711a9df37f359159b21db56cea9c21f58a9c`
- `Linux >= c1d6708bf0d3dd976460d435373cf5abf21ce258 < ec2612b8ad9e642596db011dd8b6568ef1edeaa1`
- `Linux d943536197c1a05e377452af4ec7942e11d018f4`
- `Linux dbaca8fa9ec2c5aa55ec515686ce3b9007554eab`
- `Linux 79187e8099a9feb550916dbfb962497522022b6d`
- `Linux >= 5.10.210 < 5.10.261`
- `Linux >= 5.15.149 < 5.15.212`
- `Linux >= 6.1.79 < 6.1.178`
- `Linux >= 6.6.18 < 6.6.145`
- `Linux >= 4.19.307 < 4.20`
- `Linux >= 5.4.269 < 5.5`
- `Linux >= 6.7.6 < 6.8`
- `Linux 6.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.