CVE-2026-31625 HID: alps: fix NULL pointer dereference in alps_raw_event()
A missing NULL pointer check in the Linux kernel's Alps HID driver allows attackers to cause a system crash via crafted input.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31625?
CVE-2026-31625 is a medium-severity vulnerability in Linux kernel, published on 24 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
HID: alps: fix NULL pointer dereference in alps_raw_event()
Commit ecfa6f34492c ("HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them") attempted to fix up the HID drivers that had missed the previous fix that was done in 2ff5baa9b527 ("HID: appleir: Fix potential NULL dereference at raw event handle"), but the alps driver was missed.
Fix this up by properly checking in the hid-alps driver that it had been claimed correctly before attempting to process the raw event.
Weakness: CWE-476
Which versions are affected by CVE-2026-31625?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31625?
Apply the vendor's patch.
Is CVE-2026-31625 being exploited?
There is no known exploitation of CVE-2026-31625 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-83867, BELL-CVE-2026-31625, DEBIAN-CVE-2026-31625, GHSA-9m92-4vqv-mrj9, ROOT-OS-DEBIAN-11-CVE-2026-31625, ROOT-OS-DEBIAN-12-CVE-2026-31625 and 4 more.