CVE-2026-98502
In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps_input_configured() allocates a second input device ("DualPoint Stick") with input_allocate_device() and registers it, but the alps_driver struct has no .remove handler and input2 is not tracked in hdev->inputs. The default remove path (hid_hw_stop -> hidinput_disconnect) only iterates hdev->inputs, so input2 is never unregistered and leaks on every device removal. Add a .remove handler that stops the device first (preventing URB callbacks from touching input2 during teardown) and then unregisters input2.
Affected versions
Linux kernel versions
4.8
and later are affected. Fixed in
6.12.112,
6.18.55,
7.2.9,
7.3
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-98502?
CVE-2026-98502 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.8 onward and has been patched in 6.12.112, 6.18.55, 7.2.9 and others. CVE-2026-98502 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98502?
Yes. CVE-2026-98502 has been patched. Fixed versions include 6.12.112, 6.18.55, 7.2.9 and others. If you are running Linux kernel 4.8 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98502 actively exploited?
No. CVE-2026-98502 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.