Cloudanix VulnDB

CVE-2026-98501

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how Linux handles certain touchpad hardware can let attackers crash the system or run code with full privileges if they can plug in or control that hardware.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the ALPS HID driver where a pointer to a freed input device remains accessible after registration failure, allowing a subsequent HID report to dereference invalid memory while URBs are active.

Why it matters to the business

Kernel instability or potential code execution on Linux systems handling ALPS HID devices, leading to crashes, data loss, or full system compromise until patched.

How an attack unfolds

An attacker with local access or control over an ALPS HID input device triggers a registration failure path in alps_input_configured while active URBs allow raw_event to process a U1_SP_ABSOLUTE_REPORT_ID report, dereferencing the dangling pointer to freed memory.

How to fix it

Update the Linux kernel to a version containing the fix that stores input2 only after successful registration and adds a NULL check in the raw_event path; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the kernel source contains the updated alps_input_configured logic and NULL guard; confirm no UAF reports in dmesg after exercising HID registration paths on ALPS hardware.

Typical attack path

  1. Gain local access or attach malicious HID device
  2. Force alps_input_configured to attempt registration that fails
  3. Send crafted absolute report during the window before NULL guard
  4. Trigger use-after-free dereference in u1_raw_event

How to detect it

Review kernel logs for oops or panic messages referencing alps, u1_raw_event, or input2 around HID device registration events; correlate with unexpected HID device attach times.

What your security team should do

  • Prioritize kernel updates on systems with ALPS HID devices within the next patch cycle
  • Monitor vendor advisories for backported fixes in LTS kernels
  • Restrict untrusted HID device attachment via physical security or udev rules where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration failure alps_input_configured() stores data->input2 before calling input_register_device(). If registration fails, input_free_device() frees the input device but data->input2 still points to the freed memory. alps_input_configured() calls hid_hw_open() before allocating input2, so URBs are already active and raw_event can fire during the failure window. A U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event() to dereference the freed data->input2 -> use-after-free. Fix by only storing input2 into drvdata after successful registration and adding a NULL guard in the raw_event path.

Affected packages

Ecosystem Package Introduced Fixed