CVE-2026-98501
In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration failure alps_input_configured() stores data->input2 before calling input_register_device(). If registration fails, input_free_device() frees the input device but data->input2 still points to the freed memory. alps_input_configured() calls hid_hw_open() before allocating input2, so URBs are already active and raw_event can fire during the failure window. A U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event() to dereference the freed data->input2 -> use-after-free. Fix by only storing input2 into drvdata after successful registration and adding a NULL guard in the raw_event path.
Affected versions
Linux kernel versions
4.8
and later are affected. Fixed in
5.10.271,
5.15.222,
6.1.189,
6.6.158,
6.12.112,
6.18.55,
7.2.9,
7.3
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-98501?
CVE-2026-98501 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.8 onward and has been patched in 5.10.271, 5.15.222, 6.1.189 and others. CVE-2026-98501 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98501?
Yes. CVE-2026-98501 has been patched. Fixed versions include 5.10.271, 5.15.222, 6.1.189 and others. If you are running Linux kernel 4.8 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98501 actively exploited?
No. CVE-2026-98501 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.