CVE-2026-98502
Received Received - Intake

HID DualPoint Stick Input Device Leak in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps_input_configured() allocates a second input device ("DualPoint Stick") with input_allocate_device() and registers it, but the alps_driver struct has no .remove handler and input2 is not tracked in hdev->inputs. The default remove path (hid_hw_stop -> hidinput_disconnect) only iterates hdev->inputs, so input2 is never unregistered and leaks on every device removal. Add a .remove handler that stops the device first (preventing URB callbacks from touching input2 during teardown) and then unregisters input2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98502
EUVD
EUVD-2026-103742

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 2562756dde550901c224e3805102bdfc17e7d13a
Linux Linux 2562756dde550901c224e3805102bdfc17e7d13a
Linux Linux 2562756dde550901c224e3805102bdfc17e7d13a
Linux Linux 2562756dde550901c224e3805102bdfc17e7d13a
Linux Linux 4.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the HID (Human Interface Device) subsystem. Specifically, the alps driver fails to properly unregister a secondary input device called 'DualPoint Stick' when the device is removed. This happens because the driver lacks a remove handler and the device is not tracked in the main input device list. As a result, the device is not unregistered during teardown, causing a resource leak every time the device is removed.

Detection Guidance

This vulnerability is specific to the Linux kernel's HID subsystem and relates to improper handling of input devices. Detection requires checking kernel logs for related errors or examining the alps driver implementation. No direct network detection commands apply. Inspect kernel messages with 'dmesg | grep alps' or check loaded modules with 'lsmod | grep alps'.

Impact Analysis

This vulnerability primarily affects system stability and resource management. The memory leak from unregistered input devices can lead to gradual degradation of system performance over time. It may cause increased memory usage and potential system slowdowns, especially in environments where devices are frequently connected and disconnected.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this issue. Monitor vendor advisories for kernel updates addressing CVE-2026-98502. If immediate patching is not possible, consider disabling the alps driver if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98502. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart