CVE-2026-98501

Received Received - Intake

Use-After-Free in Linux Kernel HID ALPS Driver

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration failure alps_input_configured() stores data->input2 before calling input_register_device(). If registration fails, input_free_device() frees the input device but data->input2 still points to the freed memory. alps_input_configured() calls hid_hw_open() before allocating input2, so URBs are already active and raw_event can fire during the failure window. A U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event() to dereference the freed data->input2 -> use-after-free. Fix by only storing input2 into drvdata after successful registration and adding a NULL guard in the raw_event path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98501

EUVD

EUVD-2026-103741

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	2562756dde550901c224e3805102bdfc17e7d13a
Linux	Linux	2562756dde550901c224e3805102bdfc17e7d13a
Linux	Linux	2562756dde550901c224e3805102bdfc17e7d13a
Linux	Linux	2562756dde550901c224e3805102bdfc17e7d13a
Linux	Linux	2562756dde550901c224e3805102bdfc17e7d13a
Linux	Linux	2562756dde550901c224e3805102bdfc17e7d13a
Linux	Linux	2562756dde550901c224e3805102bdfc17e7d13a
Linux	Linux	2562756dde550901c224e3805102bdfc17e7d13a
Linux	Linux	4.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's HID (Human Interface Device) subsystem for ALPS touchpads. It occurs when input2 registration fails, leaving data->input2 pointing to freed memory. URBs (USB Request Blocks) are active before input2 allocation, so raw_event can trigger during the failure window, causing u1_raw_event() to dereference the freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's HID subsystem and does not have network-based detection methods. Detection requires checking kernel logs for input2 registration failures or use-after-free errors related to alps devices. Monitor dmesg or journalctl for kernel messages indicating input device failures.

Impact Analysis

This vulnerability could allow an attacker with physical access to trigger a use-after-free condition, potentially leading to system crashes, memory corruption, or privilege escalation. It primarily affects systems using ALPS touchpads.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a use-after-free issue in the Linux kernel's HID subsystem that could lead to memory corruption or crashes, but there is no evidence it involves data exposure or privacy violations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-98501. The vulnerability is resolved by ensuring input2 is only stored after successful registration and adding a NULL guard in the raw_event path. Check your distribution's security updates or kernel release notes for the patched version.

Hi! I’m here to help you understand CVE-2026-98501. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70