{"id":"CVE-2026-98502","kind":"vulnerability","aliases":["CVE-2026-98502"],"related":[],"title":"Linux kernel: ALPS HID driver leaks a DualPoint Stick input device","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: alps: unregister DualPoint Stick input device on remove\n\nalps_input_configured() allocates a second input device (\"DualPoint\nStick\") with input_allocate_device() and registers it, but the\nalps_driver struct has no .remove handler and input2 is not tracked in\nhdev->inputs.  The default remove path (hid_hw_stop -> hidinput_disconnect)\nonly iterates hdev->inputs, so input2 is never unregistered and leaks\non every device removal.\n\nAdd a .remove handler that stops the device first (preventing URB\ncallbacks from touching input2 during teardown) and then unregisters\ninput2.","summary":"The ALPS HID driver in the Linux kernel registers a second input device for the DualPoint Stick but never unregisters it when the device is removed. The leak happens on every device removal and the sources do not describe a direct way for an attacker to gain access.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alps-touchpad","laptops","linux-kernel","runtime"],"not_affected_if":["no-alps-hardware"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit adding a .remove handler to the ALPS HID driver (version not stated in the sources)","status":"open","published_at":"2026-10-18T16:17:01+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:31+00:00","updated_at":"2026-10-25T05:25:31+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:25:31Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit adding a .remove handler to the ALPS HID driver (version not stated in the sources)","reach":"local","title":"Linux kernel: ALPS HID driver leaks a DualPoint Stick input device","impact":"low","summary":"The ALPS HID driver in the Linux kernel registers a second input device for the DualPoint Stick but never unregisters it when the device is removed. The leak happens on every device removal and the sources do not describe a direct way for an attacker to gain access.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","laptops","alps-touchpad"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown: a resource leak on device removal, with no code execution described","analyst_note":"","how_to_check":"- unknown","needs_analyst":false,"not_affected_if":["no-alps-hardware"],"who_is_affected":"Systems running a Linux kernel with the HID ALPS driver loaded, typically laptops with ALPS touchpads that have a DualPoint Stick. The sources do not describe a remote path, so servers without such hardware are unlikely to be affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00057,"input_tokens":3444,"output_tokens":451,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98502':14A,17A 'access':73B 'add':151C 'alloc':96C,105C 'alp':3A,19B,27B,85C,93C,112C 'alps-touchpad':18B 'attack':70B 'callback':162C 'configur':95C 'cve':12A,15A 'default':128C 'describ':64B 'devic':11A,38B,49B,57B,90C,100C,106C,149C,158C 'direct':66B 'disconnect':135C 'driver':5A,29B,113C 'dualpoint':8A,41B,87C,101C 'everi':56B,148C 'first':159C 'follow':79C 'gain':72B 'handler':118C,154C 'happen':54B 'hdev':125C,138C 'hid':4A,28B,84C,131C 'hidinput':134C 'hw':132C 'input':10A,37B,89C,94C,99C,104C,126C,139C 'input2':120C,141C,165C,171C 'iter':137C 'kernel':2A,24B,33B,77C 'laptop':21B 'leak':6A,53B,146C 'linux':1A,23B,32B,76C 'linux-kernel':22B 'never':44B,143C 'path':130C 'prevent':160C 'regist':34B,108C 'remov':51B,58B,92C,117C,129C,150C,153C 'resolv':83C 'runtim':25B 'second':36B,98C 'sourc':61B 'stick':9A,42B,88C,102C 'stop':133C,156C 'struct':114C 'teardown':167C 'touch':164C 'touchpad':20B 'track':123C 'unregist':45B,86C,144C,170C 'urb':161C 'vulner':80C 'way':67B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the HID ALPS driver loaded, typically laptops with ALPS touchpads that have a DualPoint Stick. The sources do not describe a remote path, so servers without such hardware are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98502","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98502","severity":null,"published_at":"2026-10-18T16:17:01+00:00","modified_at":"2026-10-21T13:21:32+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}