CVE-2026-31625

HID: alps: fix NULL pointer dereference in alps_raw_event()

State: Published
Severity: Not scored
Published: Apr 24, 2026
Updated: Oct 15, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: alps: fix NULL pointer dereference in alps_raw_event()

Commit ecfa6f34492c ("HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them") attempted to fix up the HID drivers that had missed the previous fix that was done in 2ff5baa9b527 ("HID: appleir: Fix potential NULL dereference at raw event handle"), but the alps driver was missed.

Fix this up by properly checking in the hid-alps driver that it had been claimed correctly before attempting to process the raw event.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	73196ebe134d11a68a2e27814c489d685cfc8b03 to before 56850666bb5dcf7a13d76c5d02864813e17ee537Affected 73196ebe134d11a68a2e27814c489d685cfc8b03 to before 72516a8d7fe247fd895424bab87952f105a0c255Affected 73196ebe134d11a68a2e27814c489d685cfc8b03 to before cc411e4823d8bfa23327d9989a0fa4e0ce76aebeAffected 73196ebe134d11a68a2e27814c489d685cfc8b03 to before c8cc765253ad89ccc106a7bdeb5aeac6cf963078Affected 73196ebe134d11a68a2e27814c489d685cfc8b03 to before 8eed7bce7a4c41ab28ee4891103623a12fd41611Affected 73196ebe134d11a68a2e27814c489d685cfc8b03 to before 0091dfa542a362c178a7e9393097138a57d327d1Affected 73196ebe134d11a68a2e27814c489d685cfc8b03 to before 4b618248d2307a219d9431a730cfe1156c8e3386Affected 73196ebe134d11a68a2e27814c489d685cfc8b03 to before ee2cb3ddfdca949dbc0c3f796ed5a439f0efc9f6Affected 73196ebe134d11a68a2e27814c489d685cfc8b03 to before 1badfc4319224820d5d890f8eab6aa52e4e83339Affected
LinuxLinux	4.15Affected before 4.15Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.136 through 6.6.Not affected 6.12.83 through 6.12.Not affected 6.18.24 through 6.18.Not affected 6.19.14 through 6.19.Not affected 7.0.1 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

73196ebe134d11a68a2e27814c489d685cfc8b03 to before 56850666bb5dcf7a13d76c5d02864813e17ee537Affected
73196ebe134d11a68a2e27814c489d685cfc8b03 to before 72516a8d7fe247fd895424bab87952f105a0c255Affected
73196ebe134d11a68a2e27814c489d685cfc8b03 to before cc411e4823d8bfa23327d9989a0fa4e0ce76aebeAffected
73196ebe134d11a68a2e27814c489d685cfc8b03 to before c8cc765253ad89ccc106a7bdeb5aeac6cf963078Affected
73196ebe134d11a68a2e27814c489d685cfc8b03 to before 8eed7bce7a4c41ab28ee4891103623a12fd41611Affected
73196ebe134d11a68a2e27814c489d685cfc8b03 to before 0091dfa542a362c178a7e9393097138a57d327d1Affected
73196ebe134d11a68a2e27814c489d685cfc8b03 to before 4b618248d2307a219d9431a730cfe1156c8e3386Affected
73196ebe134d11a68a2e27814c489d685cfc8b03 to before ee2cb3ddfdca949dbc0c3f796ed5a439f0efc9f6Affected
73196ebe134d11a68a2e27814c489d685cfc8b03 to before 1badfc4319224820d5d890f8eab6aa52e4e83339Affected

LinuxLinux

4.15Affected
before 4.15Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.136 through 6.6.*Not affected
6.12.83 through 6.12.*Not affected
6.18.24 through 6.18.*Not affected
6.19.14 through 6.19.*Not affected
7.0.1 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.