Live › vulnerability › CVE-2026-98501
Go to dashboardWhen registering a second input device for an ALPS touchpad fails, the driver keeps a pointer to the freed device, and a later HID report can write through it. An attacker who can deliver a crafted HID report to the machine could cause a use-after-free in the kernel.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the HID ALPS driver loaded, typically machines with ALPS-based touchpads such as some older laptops. The sources do not say which exact kernel versions are affected, and the trigger needs a failed input registration, so the exposure is narrow. Systems without ALPS hardware or without this driver can likely skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
HID: alps: fix use-after-free on input2 registration failure
alps_input_configured() stores data->input2 before calling input_register_device(). If registration fails, input_free_device() frees the input device but data->input2 still points to the freed memory. alps_input_configured() calls hid_hw_open() before allocating input2, so URBs are already active and raw_event can fire during the failure window. A U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event() to dereference the freed data->input2 -> use-after-free.
Fix by only storing input2 into drvdata after successful registration and adding a NULL guard in the raw_event path.
This page as .md · .json · in your agent: get_signal("CVE-2026-98501")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.