{"id":"CVE-2026-99069","kind":"vulnerability","aliases":["CVE-2026-99069"],"related":[],"title":"Linux kernel: ati_remote2 sysfs handlers cast the wrong device type","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: ati_remote2 - fix type confusion in device attribute handlers\n\nPreviously, the channel_mask and mode_mask attributes were registered on\nthe parent usb_device via sysfs_create_group(). When commit b20d6bf8014b\n(\"Input: ati-remote2 - use driver core to instantiate device\nattributes\") converted the driver to let the driver core manage them via\ndev_groups in struct usb_driver, the attributes moved to the bound\nusb_interface devices, but the show and store callbacks were not updated\naccordingly.\n\nAs a result, the callbacks still invoked to_usb_device() on a device\npointer belonging to a struct usb_interface, producing an invalid\nusb_device pointer.\n\nUse to_usb_interface() directly in the attribute handlers to obtain the\ninterface and its driver data.","summary":"The ati_remote2 input driver's channel_mask and mode_mask sysfs attribute handlers treat a usb_interface device as a usb_device, producing an invalid pointer. The sources do not state what an attacker can get from this beyond the type confusion itself.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ati-remote2","kernel","linux","package","usb"],"not_affected_if":["no-ati-remote2-driver"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:30+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:53:46+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T04:53:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: ati_remote2 sysfs handlers cast the wrong device type","impact":"low","summary":"The ati_remote2 input driver's channel_mask and mode_mask sysfs attribute handlers treat a usb_interface device as a usb_device, producing an invalid pointer. The sources do not state what an attacker can get from this beyond the type confusion itself.","category":"package","nicknames":[],"who_cares":["linux","kernel","usb","ati-remote2"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Find the upstream kernel commit fixing ati_remote2 and the affected kernel version ranges on NVD; the sources give no versions or severity.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-ati-remote2-driver"],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000532,"input_tokens":3503,"output_tokens":364,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99069':14A,17A 'accord':156C 'ati':3A,19B,26B,79C,112C 'ati-remote2':18B,111C 'attack':59B 'attribut':37B,86C,95C,120C,139C,190C 'b20d6bf8014b':109C 'belong':171C 'beyond':64B 'bound':143C 'callback':152C,161C 'cast':7A 'channel':31B,90C 'commit':108C 'confus':67B,83C 'convert':121C 'core':116C,128C 'creat':105C 'cve':12A,15A 'data':199C 'dev':132C 'devic':10A,43B,47B,85C,102C,119C,146C,166C,169C,181C 'direct':187C 'driver':29B,115C,123C,127C,137C,198C 'fix':81C 'follow':73C 'get':61B 'group':106C,133C 'handler':6A,38B,87C,191C 'input':28B,78C,110C 'instanti':118C 'interfac':42B,145C,176C,186C,195C 'invalid':50B,179C 'invok':163C 'kernel':2A,21B,71C 'let':125C 'linux':1A,22B,70C 'manag':129C 'mask':32B,35B,91C,94C 'mode':34B,93C 'move':140C 'obtain':193C 'packag':23B 'parent':100C 'pointer':51B,170C,182C 'previous':88C 'produc':48B,177C 'regist':97C 'remote2':4A,20B,27B,80C,113C 'resolv':77C 'result':159C 'show':149C 'sourc':53B 'state':56B 'still':162C 'store':151C 'struct':135C,174C 'sysf':5A,36B,104C 'treat':39B 'type':11A,66B,82C 'updat':155C 'usb':24B,41B,46B,101C,136C,144C,165C,175C,180C,185C 'use':114C,183C 'via':103C,131C 'vulner':74C 'wrong':9A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99069","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99069","severity":null,"published_at":"2026-10-23T13:17:30+00:00","modified_at":"2026-10-23T13:17:30+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99069","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99069","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}