{"id":"CVE-2026-98501","kind":"vulnerability","aliases":["CVE-2026-98501"],"related":[],"title":"Linux kernel: ALPS HID driver use-after-free on input registration failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: alps: fix use-after-free on input2 registration failure\n\nalps_input_configured() stores data->input2 before calling\ninput_register_device().  If registration fails, input_free_device()\nfrees the input device but data->input2 still points to the freed memory.\nalps_input_configured() calls hid_hw_open() before allocating input2, so\nURBs are already active and raw_event can fire during the failure window.\nA U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event()\nto dereference the freed data->input2 -> use-after-free.\n\nFix by only storing input2 into drvdata after successful registration\nand adding a NULL guard in the raw_event path.","summary":"When registering a second input device for an ALPS touchpad fails, the driver keeps a pointer to the freed device, and a later HID report can write through it. An attacker who can deliver a crafted HID report to the machine could cause a use-after-free in the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alps-touchpad","infrastructure","laptops","linux-kernel"],"not_affected_if":["no-alps-hardware"],"how_to_check":"- unknown","fix":"- Install a Linux kernel build that includes the upstream fix for HID: alps (the input2 use-after-free), as published by your distribution; the sources do not name a version.","status":"open","published_at":"2026-10-18T16:17:01+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:33+00:00","updated_at":"2026-10-25T05:25:33+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:25:33Z","model":"claude-haiku-5-5","output":{"fix":"- Install a Linux kernel build that includes the upstream fix for HID: alps (the input2 use-after-free), as published by your distribution; the sources do not name a version.","reach":"local","title":"Linux kernel: ALPS HID driver use-after-free on input registration failure","impact":"high","summary":"When registering a second input device for an ALPS touchpad fails, the driver keeps a pointer to the freed device, and a later HID report can write through it. An attacker who can deliver a crafted HID report to the machine could cause a use-after-free in the kernel.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","laptops","alps-touchpad"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory corruption from a crafted HID report, possibly code execution","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges and whether the trigger is physical or remote.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-alps-hardware"],"who_is_affected":"Systems running a Linux kernel with the HID ALPS driver loaded, typically machines with ALPS-based touchpads such as some older laptops. The sources do not say which exact kernel versions are affected, and the trigger needs a failed input registration, so the exposure is narrow. Systems without ALPS hardware or without this driver can likely skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000612,"input_tokens":3462,"output_tokens":531,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98501':16A,19A 'absolut':157C 'activ':144C 'add':188C 'alloc':138C 'alp':3A,21B,36B,90C,100C,130C 'alps-touchpad':20B 'alreadi':143C 'arriv':161C 'attack':58B 'call':107C,133C 'caus':70B,163C 'configur':102C,132C 'could':69B 'craft':63B 'cve':14A,17A 'data':104C,122C,171C 'deliv':61B 'derefer':168C 'devic':33B,47B,110C,116C,120C 'driver':5A,40B 'drvdata':183C 'event':147C,166C,195C 'fail':38B,113C 'failur':13A,99C,152C 'fire':149C 'fix':91C,177C 'follow':84C 'free':9A,75B,95C,115C,117C,176C 'freed':46B,128C,170C 'guard':191C 'hid':4A,51B,64B,89C,134C 'hw':135C 'id':159C 'infrastructur':23B 'input':11A,32B,101C,108C,114C,119C,131C 'input2':97C,105C,123C,139C,172C,181C 'keep':41B 'kernel':2A,27B,78B,82C 'laptop':24B 'later':50B 'linux':1A,26B,81C 'linux-kernel':25B 'machin':68B 'memori':129C 'null':190C 'open':136C 'path':196C 'point':125C 'pointer':43B 'raw':146C,165C,194C 'regist':29B,109C 'registr':12A,98C,112C,186C 'report':52B,65B,158C,160C 'resolv':88C 'second':31B 'sp':156C 'still':124C 'store':103C,180C 'success':185C 'touchpad':22B,37B 'u1':155C,164C 'urb':141C 'use':7A,73B,93C,174C 'use-after-fre':6A,72B,92C,173C 'vulner':85C 'window':153C 'write':54B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the HID ALPS driver loaded, typically machines with ALPS-based touchpads such as some older laptops. The sources do not say which exact kernel versions are affected, and the trigger needs a failed input registration, so the exposure is narrow. Systems without ALPS hardware or without this driver can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98501","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98501","severity":null,"published_at":"2026-10-18T16:17:01+00:00","modified_at":"2026-10-19T10:19:03+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}