CVE-2026-98501
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
39/100
Published: 2026-10-18
Modified: 2026-10-24
First seen: 2026-10-29
Status: active
Attack Surface
Adjacent
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Adjacent
AC:
High
PR:
None
UI:
Required
S:
Unchanged
C:
High
I:
High
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration failure alps_input_configured() stores data->input2 before calling input_register_device(). If registration fails, input_free_device() frees the input device but data->input2 still points to the freed memory. alps_input_configured() calls hid_hw_open() before allocating input2, so URBs are already active and raw_event can fire during the failure window. A U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event() to dereference the freed data->input2 -> use-after-free. Fix by only storing input2 into drvdata after successful registration and adding a NULL guard in the raw_event path.