CVE-2026-98502 HID: alps: unregister DualPoint Stick input device on remove
A missing unregister handler in the Alps HID driver causes a memory leak on device removal, potentially leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98502?
CVE-2026-98502 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
HID: alps: unregister DualPoint Stick input device on remove
alps_input_configured() allocates a second input device ("DualPoint Stick") with input_allocate_device() and registers it, but the alps_driver struct has no .remove handler and input2 is not tracked in hdev->inputs. The default remove path (hid_hw_stop -> hidinput_disconnect) only iterates hdev->inputs, so input2 is never unregistered and leaks on every device removal.
Add a .remove handler that stops the device first (preventing URB callbacks from touching input2 during teardown) and then unregisters input2.
Which versions are affected by CVE-2026-98502?
How do I fix CVE-2026-98502?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98502 being exploited?
There is no known exploitation of CVE-2026-98502 in the wild and no public exploit code.
Sources
Also known as AZL-108611, BELL-CVE-2026-98502, DEBIAN-CVE-2026-98502, GHSA-79qw-7wgp-r9xr, UBUNTU-CVE-2026-98502.