CVE-2026-98501

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98501", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.353Z", "datePublished": "2026-10-18T15:16:46.205Z", "dateUpdated": "2026-10-24T14:09:09.356Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:09:09.356Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: alps: fix use-after-free on input2 registration failure\n\nalps_input_configured() stores data->input2 before calling\ninput_register_device(). If registration fails, input_free_device()\nfrees the input device but data->input2 still points to the freed memory.\nalps_input_configured() calls hid_hw_open() before allocating input2, so\nURBs are already active and raw_event can fire during the failure window.\nA U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event()\nto dereference the freed data->input2 -> use-after-free.\n\nFix by only storing input2 into drvdata after successful registration\nand adding a NULL guard in the raw_event path."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - `alps_id` uses `HID_BUS_ANY`, so a Bluetooth HIDP peer can bind `hid-alps`; its L2CAP ID-6 report follows `hidp_process_report()->hid_input_report()->alps_raw_event()->u1_raw_event()`, which dereferences the pointer left stale by `alps_input_configured()`.\nAC:H - The peer controls stick support and ID-6 report timing, and asynchronous `hidp_session_dev_work()` permits concurrency, but it cannot force `input_register_device(input2)` to fail; that requires a host-side allocation, device-model, or lock-interruption failure.\nPR:N - After the HIDP session is established, `hidp_session_run()` passes peer-supplied interrupt-channel reports to `hid_input_report()` without any per-report host privilege check; the nearby peer needs no kernel credential.\nUI:R - The victim must pair or connect the attacker's spoofed ALPS Bluetooth HID peer so BlueZ establishes the HIDP session and `hid-alps` probes it; subsequent triggering reports need no further action.\nS:U - The stale `data->input2` and the memory corrupted through it are host-kernel input-core objects; `u1_raw_event()` crosses no VM, IOMMU, or other security-authority boundary.\nC:H - The freed `struct input_dev` contains `vals`, `grab`, and handler-list pointers; after heap reuse, ID-6 reports drive `input_event()` and `input_pass_values()` through attacker-influenced reclaimed fields, permitting arbitrary kernel-memory disclosure.\nI:H - `input_event_dispose()` writes attacker-selected relative and button values through the reclaimed `input_dev->vals` pointer, while `input_pass_values()` follows reclaimed handler pointers, supporting arbitrary writes and control-flow hijacking.\nA:H - `u1_raw_event()` passes the freed pointer to `input_event()`, which reads `evbit`, takes `event_lock`, and accesses `vals` and handler lists; invalid reclaimed state can immediately cause an oops, panic, or lockup."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hid/hid-alps.c"], "versions": [{"version": "2562756dde550901c224e3805102bdfc17e7d13a", "lessThan": "64f824dccfd316fd3db8ea1cc4e8a76ad6a02740", "status": "affected", "versionType": "git"}, {"version": "2562756dde550901c224e3805102bdfc17e7d13a", "lessThan": "2e55d76e6e8a756f6d87c241de975599f82b02fa", "status": "affected", "versionType": "git"}, {"version": "2562756dde550901c224e3805102bdfc17e7d13a", "lessThan": "ef8ca5bb4c8b9696f38b1bebce1c851baa02b77b", "status": "affected", "versionType": "git"}, {"version": "2562756dde550901c224e3805102bdfc17e7d13a", "lessThan": "5a8ad63158165bacd6a1d7420e0fe5364c913b06", "status": "affected", "versionType": "git"}, {"version": "2562756dde550901c224e3805102bdfc17e7d13a", "lessThan": "47e5e177e9e4e10da6f2759d5ce8d049e33efdc4", "status": "affected", "versionType": "git"}, {"version": "2562756dde550901c224e3805102bdfc17e7d13a", "lessThan": "925da1d2a24787f24872de13a4680437c54de179", "status": "affected", "versionType": "git"}, {"version": "2562756dde550901c224e3805102bdfc17e7d13a", "lessThan": "443f6b93442b10b972a16f57ceaaea75b77892b6", "status": "affected", "versionType": "git"}, {"version": "2562756dde550901c224e3805102bdfc17e7d13a", "lessThan": "d3aba3442798ce4a4c8ce3104d7b286d61e605f9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hid/hid-alps.c"], "versions": [{"version": "4.8", "status": "affected"}, {"version": "0", "lessThan": "4.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/64f824dccfd316fd3db8ea1cc4e8a76ad6a02740"}, {"url": "https://git.kernel.org/stable/c/2e55d76e6e8a756f6d87c241de975599f82b02fa"}, {"url": "https://git.kernel.org/stable/c/ef8ca5bb4c8b9696f38b1bebce1c851baa02b77b"}, {"url": "https://git.kernel.org/stable/c/5a8ad63158165bacd6a1d7420e0fe5364c913b06"}, {"url": "https://git.kernel.org/stable/c/47e5e177e9e4e10da6f2759d5ce8d049e33efdc4"}, {"url": "https://git.kernel.org/stable/c/925da1d2a24787f24872de13a4680437c54de179"}, {"url": "https://git.kernel.org/stable/c/443f6b93442b10b972a16f57ceaaea75b77892b6"}, {"url": "https://git.kernel.org/stable/c/d3aba3442798ce4a4c8ce3104d7b286d61e605f9"}], "title": "HID: alps: fix use-after-free on input2 registration failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/hid/hid-alps.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "64f824dccfd316fd3db8ea1cc4e8a76ad6a02740", "status": "affected", "version": "2562756dde550901c224e3805102bdfc17e7d13a", "versionType": "git"}, {"lessThan": "2e55d76e6e8a756f6d87c241de975599f82b02fa", "status": "affected", "version": "2562756dde550901c224e3805102bdfc17e7d13a", "versionType": "git"}, {"lessThan": "ef8ca5bb4c8b9696f38b1bebce1c851baa02b77b", "status": "affected", "version": "2562756dde550901c224e3805102bdfc17e7d13a", "versionType": "git"}, {"lessThan": "5a8ad63158165bacd6a1d7420e0fe5364c913b06", "status": "affected", "version": "2562756dde550901c224e3805102bdfc17e7d13a", "versionType": "git"}, {"lessThan": "47e5e177e9e4e10da6f2759d5ce8d049e33efdc4", "status": "affected", "version": "2562756dde550901c224e3805102bdfc17e7d13a", "versionType": "git"}, {"lessThan": "925da1d2a24787f24872de13a4680437c54de179", "status": "affected", "version": "2562756dde550901c224e3805102bdfc17e7d13a", "versionType": "git"}, {"lessThan": "443f6b93442b10b972a16f57ceaaea75b77892b6", "status": "affected", "version": "2562756dde550901c224e3805102bdfc17e7d13a", "versionType": "git"}, {"lessThan": "d3aba3442798ce4a4c8ce3104d7b286d61e605f9", "status": "affected", "version": "2562756dde550901c224e3805102bdfc17e7d13a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/hid/hid-alps.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.8"}, {"lessThan": "4.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: alps: fix use-after-free on input2 registration failure\n\nalps_input_configured() stores data->input2 before calling\ninput_register_device(). If registration fails, input_free_device()\nfrees the input device but data->input2 still points to the freed memory.\nalps_input_configured() calls hid_hw_open() before allocating input2, so\nURBs are already active and raw_event can fire during the failure window.\nA U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event()\nto dereference the freed data->input2 -> use-after-free.\n\nFix by only storing input2 into drvdata after successful registration\nand adding a NULL guard in the raw_event path."}], "id": "CVE-2026-98501", "lastModified": "2026-10-24T14:16:44.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-18T16:17:01.143", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2e55d76e6e8a756f6d87c241de975599f82b02fa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/443f6b93442b10b972a16f57ceaaea75b77892b6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/47e5e177e9e4e10da6f2759d5ce8d049e33efdc4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5a8ad63158165bacd6a1d7420e0fe5364c913b06"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/64f824dccfd316fd3db8ea1cc4e8a76ad6a02740"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/925da1d2a24787f24872de13a4680437c54de179"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d3aba3442798ce4a4c8ce3104d7b286d61e605f9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ef8ca5bb4c8b9696f38b1bebce1c851baa02b77b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: HID: alps: fix use-after-free on input2 registration failure", "id": "2554853", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554853"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nHID: alps: fix use-after-free on input2 registration failure\nalps_input_configured() stores data->input2 before calling\ninput_register_device(). If registration fails, input_free_device()\nfrees the input device but data->input2 still points to the freed memory.\nalps_input_configured() calls hid_hw_open() before allocating input2, so\nURBs are already active and raw_event can fire during the failure window.\nA U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event()\nto dereference the freed data->input2 -> use-after-free.\nFix by only storing input2 into drvdata after successful registration\nand adding a NULL guard in the raw_event path.", "A flaw was found in the Linux kernel's Alps Human Interface Device (HID) driver. If registration of an input device fails during configuration, the driver frees the device memory while communication channels are already active, leaving a dangling reference. An attacker capable of attaching a malicious device or sending crafted input reports can trigger a use-after-free condition during this failure window. This flaw primarily results in a Denial of Service (DoS) through a kernel crash, and may potentially allow arbitrary code execution."], "name": "CVE-2026-98501", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98501\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98501\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98501.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2562756dde550901c224e3805102bdfc17e7d13a,64f824dccfd316fd3db8ea1cc4e8a76ad6a02740)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2562756dde550901c224e3805102bdfc17e7d13a,2e55d76e6e8a756f6d87c241de975599f82b02fa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2562756dde550901c224e3805102bdfc17e7d13a,ef8ca5bb4c8b9696f38b1bebce1c851baa02b77b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2562756dde550901c224e3805102bdfc17e7d13a,5a8ad63158165bacd6a1d7420e0fe5364c913b06)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2562756dde550901c224e3805102bdfc17e7d13a,47e5e177e9e4e10da6f2759d5ce8d049e33efdc4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2562756dde550901c224e3805102bdfc17e7d13a,925da1d2a24787f24872de13a4680437c54de179)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2562756dde550901c224e3805102bdfc17e7d13a,443f6b93442b10b972a16f57ceaaea75b77892b6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2562756dde550901c224e3805102bdfc17e7d13a,d3aba3442798ce4a4c8ce3104d7b286d61e605f9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T17:00:09.233504+00:00", "updated": "2026-10-24T19:30:07.831816+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}