AUGUST 22, 2026
Live Feed
Back to database
Case File

CVE-2026-68087

UNKNOWN · CVSS N/A EPSS 0.17%

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-22

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's handling of USB HID devices, specifically within the Wacom driver, where the `wacom_wac_queue_flush()` function is improperly using GFP_KERNEL for memory allocation in an atomic context. This can lead to a "scheduling while atomic" bug, potentially causing system instability or crashes. Linux distributions utilizing the Wacom driver should prioritize this fix to ensure reliable operation of connected devices.

CVE
CVE-2026-68087
Severity
UNKNOWN
CVSS
N/A
EPSS
0.17%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush() wacom_wac_queue_flush() is called via the .raw_event callback (wacom_raw_event → wacom_wac_pen_serial_enforce → wacom_wac_queue_flush). For USB HID devices, this callback is invoked from hid_irq_in(), which is a URB completion handler running in atomic context. Using GFP_KERNEL in this path can sleep, leading to a "scheduling while atomic" bug. Use GFP_ATOMIC instead. The existing code already handles allocation failure by skipping the fifo entry and continuing.