CVE-2026-98502
In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps_input_configured() alloca…
Impact
In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps_input_configured() allocates a second input device ("DualPoint Stick") with input_allocate_device() and registers it, but the alps_driver struct has no .remove handler and input2 is not tracked in hdev->inputs. The default remove path (hid_hw_stop -> hidinput_disconnect) only iterates hdev->inputs, so input2 is never unregistered and leaks on every device removal. Add a .remove handler that stops the device first (preventing URB callbacks from touching input2 during teardown) and then unregisters input2.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
References
- NVD record
- CVE.org record
- https://git.kernel.org/stable/c/0cd13b96e00cacf1b252814442d197fdff0b1f4f
- https://git.kernel.org/stable/c/10c14ba9a2f75be78bde46fb7f5432bf02b39676
- https://git.kernel.org/stable/c/1170ebfba562b3938ff7749b2e42e4420f19436d
- https://git.kernel.org/stable/c/3efab2a65f6062fa80322095a124c16e2fe0f119
- https://git.kernel.org/stable/c/978e801750c7b0859e87eae619f7d88fcd88333e
- https://git.kernel.org/stable/c/aa4845a710ae9fee6a3831f5c338904cea77c3aa
- https://git.kernel.org/stable/c/aa9dde93e05a837645fdfd577eea71f0733f0694
- https://git.kernel.org/stable/c/bd9571812d02242b6bba2637fba924a78a5c6fa8