CVE-2026-98859

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: multitouch: stop the release timer from being rearmed on remove

mt_remove() quiesces the sticky-finger timer before stopping the

hardware:

timer_delete_sync(&td->release_timer);

sysfs_remove_group(&hdev->dev.kobj, &mt_attribute_group);

hid_hw_stop(hdev);

timer_delete_sync() waits for a running callback and dequeues the timer,

but it does not stop the timer from being armed again. The transport is

still delivering reports at that point, and the report path rearms it:

if (app->quirks & MT_QUIRK_STICKY_FINGERS) {

if (td->mt_io_flags & MT_IO_SLOTS_MASK)

mod_timer(&td->release_timer,

jiffies + msecs_to_jiffies(100));

A report that arrives after timer_delete_sync() has returned therefore

leaves the timer queued. td is allocated with devm_kzalloc() against

hdev->dev, so it is freed when the driver is unbound, after mt_remove()

returns. When the timer fires

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References