CVE-2026-98501: HID: alps: fix use-after-free on input2 registration failure
In the Linux kernel, the following vulnerability has been resolved:
HID: alps: fix use-after-free on input2 registration failure
alpsinputconfigured() stores data->input2 before calling inputregisterdevice(). If registration fails, inputfreedevice() frees the input device but data->input2 still points to the freed memory. alpsinputconfigured() calls hidhwopen() before allocating input2, so URBs are already active and rawevent can fire during the failure window. A U1SPABSOLUTEREPORTID report arriving then causes u1rawevent() to dereference the freed data->input2 -> use-after-free.
Fix by only storing input2 into drvdata after successful registration and adding a NULL guard in the rawevent path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the HID Alps driver, assign data->input2 only after input_register_device() succeeds; call input_free_device() when registration fails, and add a NULL guard in the raw_event path to prevent dereferencing freed data->input2 while URBs are active.