Strix
73.2K

CVE-2026-98502

UnknownEPSS 0.20%

Last modified

CVE-2026-98502 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps_input_configured() allocates a second input device ("DualPoint Stick") with input_allocate_device() and registers it, but the alps_driver struct has no .remove handler and input2 is not tracked in hdev->inputs. The default remove path (hid_hw_stop -> hidinput_disconnect) only iterates hdev->inputs, so input2 is never unregistered and leaks on every device removal. Add a .remove handler that stops the device first (preventing URB callbacks from touching input2 during teardown) and then unregisters input2.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps_input_configured() allocates a second input device ("DualPoint Stick") with input_allocate_device() and registers it, but the alps_driver struct has no .remove handler and input2 is not tracked in hdev->inputs. The default remove path (hid_hw_stop -> hidinput_disconnect) only iterates hdev->inputs, so input2 is never unregistered and leaks on every device removal. Add a .remove handler that stops the device first (preventing URB callbacks from touching input2 during teardown) and then unregisters input2.

Metrics

EPSS Probability
0.20%

9.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 2562756dde550901c224e3805102bdfc17e7d13a, < 10c14ba9a2f75be78bde46fb7f5432bf02b39676; >= 2562756dde550901c224e3805102bdfc17e7d13a, < 3efab2a65f6062fa80322095a124c16e2fe0f119; >= 2562756dde550901c224e3805102bdfc17e7d13a, < 0cd13b96e00cacf1b252814442d197fdff0b1f4f; >= 2562756dde550901c224e3805102bdfc17e7d13a, < bd9571812d02242b6bba2637fba924a78a5c6fa8; >= 2562756dde550901c224e3805102bdfc17e7d13a, < 1170ebfba562b3938ff7749b2e42e4420f19436d; >= 2562756dde550901c224e3805102bdfc17e7d13a, < aa4845a710ae9fee6a3831f5c338904cea77c3aa; >= 2562756dde550901c224e3805102bdfc17e7d13a, < 978e801750c7b0859e87eae619f7d88fcd88333e; >= 2562756dde550901c224e3805102bdfc17e7d13a, < aa9dde93e05a837645fdfd577eea71f0733f0694
LinuxLinux4.8

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-98502?
In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps_input_configured() allocates a second input device ("DualPoint Stick") with input_allocate_device() and registers it, but the alps_driver struct has no .remove handler and input2 is not tracked in hdev->inputs. The default remove path (hid_hw_stop -> hidinput_disconnect) only iterates hdev->inputs, so input2 is never unregistered and leaks on every device removal. Add a .remove handler that stops the device first (preventing URB callbacks from touching input2 during teardown) and then unregisters input2.
How severe is CVE-2026-98502?
Severity scoring for CVE-2026-98502 is pending analysis. The EPSS model estimates a 0.20% probability of exploitation in the next 30 days.
How do I fix CVE-2026-98502?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98502?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST