CVE-2026-98502

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: alps: unregister DualPoint Stick input device on remove

alps_input_configured() allocates a second input device ("DualPoint

Stick") with input_allocate_device() and registers it, but the

alps_driver struct has no .remove handler and input2 is not tracked in

hdev->inputs. The default remove path (hid_hw_stop -> hidinput_disconnect)

only iterates hdev->inputs, so input2 is never unregistered and leaks

on every device removal.

Add a .remove handler that stops the device first (preventing URB

callbacks from touching input2 during teardown) and then unregisters

input2.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References