Cloudanix VulnDB

CVE-2026-98502

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of certain touchpad devices can waste memory every time the device is unplugged, eventually making the computer unstable if this happens often.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The alps_input_configured function allocates and registers a secondary input device for DualPoint Stick without tracking it in hdev->inputs or providing a remove handler; the default HID disconnect path therefore never unregisters it, leaking the device structure on every removal.

Why it matters to the business

Systems that repeatedly connect and disconnect Alps HID devices experience gradual memory exhaustion, reducing stability and uptime on servers, laptops, or embedded Linux deployments that rely on hot-plug input hardware.

How an attack unfolds

An attacker with local physical access repeatedly inserts and removes a compatible Alps DualPoint device; each removal leaks kernel memory that is never reclaimed, eventually triggering OOM conditions or forcing a reboot.

How to fix it

Apply the kernel patch that adds a .remove handler to alps_driver which stops the device and unregisters the secondary input device; rebuild and deploy the updated kernel image to all affected hosts.

How to confirm the fix worked

After patching, confirm that the alps module now contains a remove function and that repeated device insertion/removal no longer increases the count of leaked input devices in /proc/meminfo or kmemleak output.

Typical attack path

  1. Obtain physical access to a target system with Alps HID hardware
  2. Repeatedly connect and disconnect the device to trigger device removal paths
  3. Accumulate leaked input device structures until memory pressure causes denial of service

How to detect it

Review kernel logs for repeated alps device registration messages without corresponding unregistration; watch for steadily increasing slab or kmalloc usage correlated with HID device events; inspect kmemleak reports for unreclaimed input_dev structures.

What your security team should do

  • Prioritize patching kernel packages on any systems that use Alps touchpad or DualPoint hardware
  • Monitor memory usage trends on endpoints with frequent HID hot-plug events
  • Add the updated kernel to the standard patch deployment pipeline within the normal change window

The record

In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps_input_configured() allocates a second input device ("DualPoint Stick") with input_allocate_device() and registers it, but the alps_driver struct has no .remove handler and input2 is not tracked in hdev->inputs. The default remove path (hid_hw_stop -> hidinput_disconnect) only iterates hdev->inputs, so input2 is never unregistered and leaks on every device removal. Add a .remove handler that stops the device first (preventing URB callbacks from touching input2 during teardown) and then unregisters input2.

Affected packages

Ecosystem Package Introduced Fixed