Cloudanix VulnDB

CVE-2026-99069

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A programming mistake in the code that manages certain USB remote controls can make the computer crash when those controls are used.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Type confusion in ati_remote2 sysfs attribute handlers where to_usb_device() is called on a struct usb_interface pointer, producing an invalid usb_device pointer and enabling memory corruption on read/write to channel_mask or mode_mask attributes.

Why it matters to the business

Potential kernel crashes or memory corruption on systems with the affected USB remote control hardware, leading to instability or denial of service for users relying on that input device.

How an attack unfolds

A local attacker interacts with the exposed sysfs attributes on the usb_interface; the unchanged callbacks perform the wrong device-type cast, dereference the invalid pointer, and trigger memory corruption that may be leveraged for further impact.

How to fix it

Apply the upstream kernel patch that replaces to_usb_device() with to_usb_interface() in the attribute show/store callbacks and rebuild or update to the fixed kernel release.

How to confirm the fix worked

Inspect the ati_remote2 driver source for use of to_usb_interface() in the attribute handlers or confirm the running kernel contains the commit titled 'Input: ati_remote2 - fix type confusion in device attribute handlers'.

Typical attack path

  1. Obtain local shell or user context on the target host
  2. Locate the ati_remote2 usb_interface sysfs directory
  3. Read or write the channel_mask or mode_mask attribute files
  4. Trigger invalid pointer dereference and memory corruption

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops, warnings, or stack traces referencing ati_remote2 attribute handlers or usb device type conversions shortly after sysfs access to the device.

What your security team should do

  • Prioritize kernel update on any system exposing the ati_remote2 driver
  • If the hardware is not required, blacklist the module to reduce attack surface
  • Monitor kernel logs for oops or warnings mentioning ati_remote2 or usb_interface attribute handling

The record

In the Linux kernel, the following vulnerability has been resolved: Input: ati_remote2 - fix type confusion in device attribute handlers Previously, the channel_mask and mode_mask attributes were registered on the parent usb_device via sysfs_create_group(). When commit b20d6bf8014b ("Input: ati-remote2 - use driver core to instantiate device attributes") converted the driver to let the driver core manage them via dev_groups in struct usb_driver, the attributes moved to the bound usb_interface devices, but the show and store callbacks were not updated accordingly. As a result, the callbacks still invoked to_usb_device() on a device pointer belonging to a struct usb_interface, producing an invalid usb_device pointer. Use to_usb_interface() directly in the attribute handlers to obtain the interface and its driver data.

Affected packages

Ecosystem Package Introduced Fixed