Live › vulnerability › CVE-2026-98502
Go to dashboardThe ALPS HID driver in the Linux kernel registers a second input device for the DualPoint Stick but never unregisters it when the device is removed. The leak happens on every device removal and the sources do not describe a direct way for an attacker to gain access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the HID ALPS driver loaded, typically laptops with ALPS touchpads that have a DualPoint Stick. The sources do not describe a remote path, so servers without such hardware are unlikely to be affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
HID: alps: unregister DualPoint Stick input device on remove
alps_input_configured() allocates a second input device ("DualPoint Stick") with input_allocate_device() and registers it, but the alps_driver struct has no .remove handler and input2 is not tracked in hdev->inputs. The default remove path (hid_hw_stop -> hidinput_disconnect) only iterates hdev->inputs, so input2 is never unregistered and leaks on every device removal.
Add a .remove handler that stops the device first (preventing URB callbacks from touching input2 during teardown) and then unregisters input2.
This page as .md · .json · in your agent: get_signal("CVE-2026-98502")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.