EUVD-2026-103741
GHSA-56g2-px47-cfcj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttach crafted ALPS HID device
-
DeliveryForce input2 registration to fail
-
ExploitSend U1_SP_ABSOLUTE_REPORT_ID report in window
-
Executionu1_raw_event dereferences freed input2
-
ImpactKernel use-after-free memory corruption
Vulnerability Assessment
| Exploitation Conditions | Requires a system running a pre-fix Linux kernel with the hid-alps (ALPS U1 touchpad) driver bound to a device, and a local/physical path to present a crafted or malfunctioning HID device whose second input device (input2) fails input_register_device(). The UAF only triggers if a U1_SP_ABSOLUTE_REPORT_ID report arrives during the narrow registration-failure window, after hid_hw_open() has already activated URBs. Limiting factors: physical/local device presence is needed (no remote or network path), the condition is an error-path race that is hard to force reliably (high attack complexity), and only kernels before the listed fixed versions are affected; systems without the ALPS driver or the triggering device are not exposed. |
| Impact | Signals point to a genuinely LOW real-world priority despite the 7.1 (High) base score. EPSS is 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit was identified - all consistent with a hardware/driver error-path bug rather than a mass-exploitable flaw. The supplied CVSS vector (AV:A/AC:H/PR:N/UI:R) is internally questionable: the hid-alps touchpad driver is not reachable over any adjacent network, so AV:A appears mislabeled - a malicious or malfunctioning USB/I2C HID device (physical/local presence) is the realistic reach, which I assess as AV:P. Both the input and my assessment agree on AC:H, reflecting the narrow failure window: the UAF only occurs if input_register_device() for input2 fails AND a U1_SP_ABSOLUTE_REPORT_ID report arrives during that window after hid_hw_open() has already activated URBs. The vendor tag 'Information Disclosure' understates the impact - this is a kernel use-after-free with C:H/I:H/A:H, i.e. potential memory corruption, not mere disclosure - but that tag mismatch does not raise the real-world likelihood. The vuln.today 'this_week' decision label is appropriate: patch in normal cadence, not an emergency. Bottom line: real but low-probability, requiring local/physical access and a race against an error path; prioritize below any network-reachable or actively-exploited issues. |
| Exploit ScenarioDerived | An attacker with physical/local access connects a crafted or faulty ALPS-class HID device that causes the second input device (input2) registration to fail; because hid_hw_open() has already enabled URBs, an incoming U1_SP_ABSOLUTE_REPORT_ID report during that failure window drives u1_raw_event() to dereference the freed data->input2, corrupting kernel memory. Successful, reliable exploitation is difficult (high attack complexity, narrow error-path race) and no public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
Use-after-free in the Linux kernel's hid-alps driver can let a locally or physically attached malformed HID device corrupt memory after the driver's second input device (input2) fails to register. alps_input_configured() publishes data->input2 into drvdata before calling input_register_device(); when registration fails, input_free_device() releases the object while the stale pointer survives, and because hid_hw_open() has already activated URBs, an incoming U1_SP_ABSOLUTE_REPORT_ID report can reach u1_raw_event() and dereference the freed device. Only systems running a pre-fix kernel with hid-alps bound to an ALPS U1 touchpad are exposed, the error-path window is narrow and hard to force (high attack complexity, physical/local vector), and no actively exploited status (not in CISA KEV) or public exploit code was identified at time of analysis; EPSS is 0.21% (11th percentile), consistent with a low real-world likelihood despite the 7.1 base score.
RemediationAI
Vendor-released patch: Linux 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55, 7.2.9 and 7.3-rc5 - updating to any of these (or to the corresponding mainline fix commit) resolves the issue by deferring the input2 assignment until input_register_device() succeeds and by NULL-guarding the raw_event path. Apply the stable commit matching your branch from the references (for example https://git.kernel.org/stable/c/64f824dccfd316fd3db8ea1cc4e8a76ad6a02740, plus the sibling commits 2e55d76e6e8a756f6d87c241de975599f82b02fa, ef8ca5bb4c8b9696f38b1bebce1c851baa02b77b, 5a8ad63158165bacd6a1d7420e0fe5364c913b06, 47e5e177e9e4e10da6f2759d5ce8d049e33efdc4, 925da1d2a24787f24872de13a4680437c54de179, 443f6b93442b10b972a16f57ceaaea75b77892b6 and d3aba3442798ce4a4c8ce3104d7b286d61e605f9), and verify the running kernel after reboot. The available sources describe no workaround and present updating as the complete fix; the exposure itself is bounded by whether hid-alps is bound to an ALPS U1 device, so systems that do not load that driver for such hardware do not reach the vulnerable error path, and that status should be confirmed rather than assumed. Patch status is vendor-confirmed, the priority label is this_week, EPSS is 0.21% (11th percentile) and the issue is not in CISA KEV, so this should be scheduled into the current patch cycle rather than treated as an emergency; driver-specific advisories are at https://git.kernel.org/stable/c/64f824dccfd316fd3db8ea1cc4e8a76ad6a02740 and https://nvd.nist.gov/vuln/detail/CVE-2026-98501.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the HID subsystem of the Linux kernel, specifically the hid-alps driver that supports ALPS touchpads including the U1 family, which split their functionality across multiple input devices. alps_input_configured() is responsible for allocating and registering the secondary input node (input2) and, in the vulnerable code, stores that pointer in driver data before input_register_device() has succeeded. Because hid_hw_open() is called earlier in the same function, the device's URBs are already in flight, so the driver's raw_event callback (u1_raw_event) can be invoked concurrently with the failure handling. When registration fails, input_free_device() frees the input device, leaving data->input2 dangling; a U1_SP_ABSOLUTE_REPORT_ID report delivered in that window dereferences the freed memory. The upstream fix defers storing input2 into drvdata until after successful registration and adds a NULL guard on the raw_event path. No CWE identifier was supplied with the record, though the behavior corresponds to a stale-pointer use-after-free in an error path. CPE data identifies the affected package as the Linux kernel (cpe:2.3:a:linux:linux), with EUVD listing affected code back to Linux 4.8, and the trigger requires an ALPS U1-class device whose second input device registration actually fails.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Reachable only via a local/physical HID device (AV:P), through a narrow registration-failure race (AC:H), needing no credentials (PR:N); kernel UAF gives full C/I/A impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
HID: alps: fix use-after-free on input2 registration failure
alps_input_configured() stores data->input2 before calling input_register_device(). If registration fails, input_free_device() frees the input device but data->input2 still points to the freed memory. alps_input_configured() calls hid_hw_open() before allocating input2, so URBs are already active and raw_event can fire during the failure window. A U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event() to dereference the freed data->input2 -> use-after-free.
Fix by only storing input2 into drvdata after successful registration and adding a NULL guard in the raw_event path.
Executive ViewAI
A memory corruption flaw in the Linux kernel's ALPS touchpad driver (CVE-2026-98501) could allow an attacker with local or physical access to a vulnerable system to crash the kernel or potentially execute code. The impact is concentrated on end-user workstations and laptops using ALPS U1 touchpads, and while exploitation is difficult and currently unproven, unpatched devices remain exposed.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB