GHSA-56G2-PX47-CFCJ

Vulnerability from github – Published: 2026-10-18 18:31 – Updated: 2026-10-24 15:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

HID: alps: fix use-after-free on input2 registration failure

alps_input_configured() stores data->input2 before calling input_register_device(). If registration fails, input_free_device() frees the input device but data->input2 still points to the freed memory. alps_input_configured() calls hid_hw_open() before allocating input2, so URBs are already active and raw_event can fire during the failure window. A U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event() to dereference the freed data->input2 -> use-after-free.

Fix by only storing input2 into drvdata after successful registration and adding a NULL guard in the raw_event path.

Severity
7.1 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-98501"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-18T16:17:01Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: alps: fix use-after-free on input2 registration failure\n\nalps_input_configured() stores data-\u003einput2 before calling\ninput_register_device().  If registration fails, input_free_device()\nfrees the input device but data-\u003einput2 still points to the freed memory.\nalps_input_configured() calls hid_hw_open() before allocating input2, so\nURBs are already active and raw_event can fire during the failure window.\nA U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event()\nto dereference the freed data-\u003einput2 -\u003e use-after-free.\n\nFix by only storing input2 into drvdata after successful registration\nand adding a NULL guard in the raw_event path.",
  "id": "GHSA-56g2-px47-cfcj",
  "modified": "2026-10-24T15:32:47Z",
  "published": "2026-10-18T18:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98501"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2e55d76e6e8a756f6d87c241de975599f82b02fa"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/443f6b93442b10b972a16f57ceaaea75b77892b6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/47e5e177e9e4e10da6f2759d5ce8d049e33efdc4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5a8ad63158165bacd6a1d7420e0fe5364c913b06"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/64f824dccfd316fd3db8ea1cc4e8a76ad6a02740"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/925da1d2a24787f24872de13a4680437c54de179"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d3aba3442798ce4a4c8ce3104d7b286d61e605f9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ef8ca5bb4c8b9696f38b1bebce1c851baa02b77b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.