CVE-2026-99069

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99069", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.389Z", "datePublished": "2026-10-23T12:23:12.396Z", "dateUpdated": "2026-10-23T12:23:12.396Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-23T12:23:12.396Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: ati_remote2 - fix type confusion in device attribute handlers\n\nPreviously, the channel_mask and mode_mask attributes were registered on\nthe parent usb_device via sysfs_create_group(). When commit b20d6bf8014b\n(\"Input: ati-remote2 - use driver core to instantiate device\nattributes\") converted the driver to let the driver core manage them via\ndev_groups in struct usb_driver, the attributes moved to the bound\nusb_interface devices, but the show and store callbacks were not updated\naccordingly.\n\nAs a result, the callbacks still invoked to_usb_device() on a device\npointer belonging to a struct usb_interface, producing an invalid\nusb_device pointer.\n\nUse to_usb_interface() directly in the attribute handlers to obtain the\ninterface and its driver data."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/input/misc/ati_remote2.c"], "versions": [{"version": "b20d6bf8014b2d6fcf65c150453d95a6276fd1fa", "lessThan": "e44ec6b6d3c0b8ea089b589fa0cce49a4da66b89", "status": "affected", "versionType": "git"}, {"version": "b20d6bf8014b2d6fcf65c150453d95a6276fd1fa", "lessThan": "d738e51bf2c21921df351f536147178ae3cbd38b", "status": "affected", "versionType": "git"}, {"version": "b20d6bf8014b2d6fcf65c150453d95a6276fd1fa", "lessThan": "2caae9d1977beea0a7914b3d86639262801fd116", "status": "affected", "versionType": "git"}, {"version": "b20d6bf8014b2d6fcf65c150453d95a6276fd1fa", "lessThan": "f321cc430c49b6c1be0d53f2ef19d8342d8029cc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/input/misc/ati_remote2.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e44ec6b6d3c0b8ea089b589fa0cce49a4da66b89"}, {"url": "https://git.kernel.org/stable/c/d738e51bf2c21921df351f536147178ae3cbd38b"}, {"url": "https://git.kernel.org/stable/c/2caae9d1977beea0a7914b3d86639262801fd116"}, {"url": "https://git.kernel.org/stable/c/f321cc430c49b6c1be0d53f2ef19d8342d8029cc"}], "title": "Input: ati_remote2 - fix type confusion in device attribute handlers", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/input/misc/ati_remote2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e44ec6b6d3c0b8ea089b589fa0cce49a4da66b89", "status": "affected", "version": "b20d6bf8014b2d6fcf65c150453d95a6276fd1fa", "versionType": "git"}, {"lessThan": "d738e51bf2c21921df351f536147178ae3cbd38b", "status": "affected", "version": "b20d6bf8014b2d6fcf65c150453d95a6276fd1fa", "versionType": "git"}, {"lessThan": "2caae9d1977beea0a7914b3d86639262801fd116", "status": "affected", "version": "b20d6bf8014b2d6fcf65c150453d95a6276fd1fa", "versionType": "git"}, {"lessThan": "f321cc430c49b6c1be0d53f2ef19d8342d8029cc", "status": "affected", "version": "b20d6bf8014b2d6fcf65c150453d95a6276fd1fa", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/input/misc/ati_remote2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: ati_remote2 - fix type confusion in device attribute handlers\n\nPreviously, the channel_mask and mode_mask attributes were registered on\nthe parent usb_device via sysfs_create_group(). When commit b20d6bf8014b\n(\"Input: ati-remote2 - use driver core to instantiate device\nattributes\") converted the driver to let the driver core manage them via\ndev_groups in struct usb_driver, the attributes moved to the bound\nusb_interface devices, but the show and store callbacks were not updated\naccordingly.\n\nAs a result, the callbacks still invoked to_usb_device() on a device\npointer belonging to a struct usb_interface, producing an invalid\nusb_device pointer.\n\nUse to_usb_interface() directly in the attribute handlers to obtain the\ninterface and its driver data."}], "id": "CVE-2026-99069", "lastModified": "2026-10-23T13:17:30.800", "metrics": {}, "published": "2026-10-23T13:17:30.800", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2caae9d1977beea0a7914b3d86639262801fd116"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d738e51bf2c21921df351f536147178ae3cbd38b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e44ec6b6d3c0b8ea089b589fa0cce49a4da66b89"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f321cc430c49b6c1be0d53f2ef19d8342d8029cc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via type confusion in ati_remote2 driver attribute handlers", "id": "2559823", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559823"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-843", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nInput: ati_remote2 - fix type confusion in device attribute handlers\nPreviously, the channel_mask and mode_mask attributes were registered on\nthe parent usb_device via sysfs_create_group(). When commit b20d6bf8014b\n(\"Input: ati-remote2 - use driver core to instantiate device\nattributes\") converted the driver to let the driver core manage them via\ndev_groups in struct usb_driver, the attributes moved to the bound\nusb_interface devices, but the show and store callbacks were not updated\naccordingly.\nAs a result, the callbacks still invoked to_usb_device() on a device\npointer belonging to a struct usb_interface, producing an invalid\nusb_device pointer.\nUse to_usb_interface() directly in the attribute handlers to obtain the\ninterface and its driver data.", "A flaw was found in the Linux kernel's ati_remote2 input driver. A local user can exploit this type confusion vulnerability to cause a Denial of Service (DoS). The issue occurs because the driver's device attribute handlers improperly treat an interface pointer as a parent device pointer. By interacting with the affected sysfs device attributes, a local user can trigger an invalid pointer dereference, leading to a system crash."], "name": "CVE-2026-99069", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-10-23T12:23:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99069\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99069\nhttps://git.kernel.org/stable/c/2caae9d1977beea0a7914b3d86639262801fd116\nhttps://git.kernel.org/stable/c/d738e51bf2c21921df351f536147178ae3cbd38b\nhttps://git.kernel.org/stable/c/e44ec6b6d3c0b8ea089b589fa0cce49a4da66b89\nhttps://git.kernel.org/stable/c/f321cc430c49b6c1be0d53f2ef19d8342d8029cc"], "statement": "This vulnerability is rated Moderate because exploitation requires local access and is limited to causing a denial of service without compromising confidentiality or integrity. In Red Hat Enterprise Linux, the ati_remote2 driver is provided as an optional kernel module that is not loaded unless the corresponding USB receiver is attached. Systems without this specialized peripheral connected are not susceptible to this crash.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b20d6bf8014b2d6fcf65c150453d95a6276fd1fa,e44ec6b6d3c0b8ea089b589fa0cce49a4da66b89)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b20d6bf8014b2d6fcf65c150453d95a6276fd1fa,d738e51bf2c21921df351f536147178ae3cbd38b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b20d6bf8014b2d6fcf65c150453d95a6276fd1fa,2caae9d1977beea0a7914b3d86639262801fd116)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b20d6bf8014b2d6fcf65c150453d95a6276fd1fa,f321cc430c49b6c1be0d53f2ef19d8342d8029cc)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b20d6bf8014b2d6fcf65c150453d95a6276fd1fa,e44ec6b6d3c0b8ea089b589fa0cce49a4da66b89)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b20d6bf8014b2d6fcf65c150453d95a6276fd1fa,d738e51bf2c21921df351f536147178ae3cbd38b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b20d6bf8014b2d6fcf65c150453d95a6276fd1fa,2caae9d1977beea0a7914b3d86639262801fd116)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b20d6bf8014b2d6fcf65c150453d95a6276fd1fa,f321cc430c49b6c1be0d53f2ef19d8342d8029cc)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T15:45:16.728343+00:00", "updated": "2026-11-03T04:30:16.905457+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}