CVE-2026-98502

HID: alps: unregister DualPoint Stick input device on remove

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: alps: unregister DualPoint Stick input device on remove

alps_input_configured() allocates a second input device ("DualPoint Stick") with input_allocate_device() and registers it, but the alps_driver struct has no .remove handler and input2 is not tracked in hdev->inputs. The default remove path (hid_hw_stop -> hidinput_disconnect) only iterates hdev->inputs, so input2 is never unregistered and leaks on every device removal.

Add a .remove handler that stops the device first (preventing URB callbacks from touching input2 during teardown) and then unregisters input2.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2562756dde550901c224e3805102bdfc17e7d13a to before 10c14ba9a2f75be78bde46fb7f5432bf02b39676Affected 2562756dde550901c224e3805102bdfc17e7d13a to before 3efab2a65f6062fa80322095a124c16e2fe0f119Affected 2562756dde550901c224e3805102bdfc17e7d13a to before 0cd13b96e00cacf1b252814442d197fdff0b1f4fAffected 2562756dde550901c224e3805102bdfc17e7d13a to before bd9571812d02242b6bba2637fba924a78a5c6fa8Affected 2562756dde550901c224e3805102bdfc17e7d13a to before 1170ebfba562b3938ff7749b2e42e4420f19436dAffected 2562756dde550901c224e3805102bdfc17e7d13a to before aa4845a710ae9fee6a3831f5c338904cea77c3aaAffected 2562756dde550901c224e3805102bdfc17e7d13a to before 978e801750c7b0859e87eae619f7d88fcd88333eAffected 2562756dde550901c224e3805102bdfc17e7d13a to before aa9dde93e05a837645fdfd577eea71f0733f0694Affected
LinuxLinux	4.8Affected before 4.8Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.55 through 6.18.Not affected 7.2.9 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

2562756dde550901c224e3805102bdfc17e7d13a to before 10c14ba9a2f75be78bde46fb7f5432bf02b39676Affected
2562756dde550901c224e3805102bdfc17e7d13a to before 3efab2a65f6062fa80322095a124c16e2fe0f119Affected
2562756dde550901c224e3805102bdfc17e7d13a to before 0cd13b96e00cacf1b252814442d197fdff0b1f4fAffected
2562756dde550901c224e3805102bdfc17e7d13a to before bd9571812d02242b6bba2637fba924a78a5c6fa8Affected
2562756dde550901c224e3805102bdfc17e7d13a to before 1170ebfba562b3938ff7749b2e42e4420f19436dAffected
2562756dde550901c224e3805102bdfc17e7d13a to before aa4845a710ae9fee6a3831f5c338904cea77c3aaAffected
2562756dde550901c224e3805102bdfc17e7d13a to before 978e801750c7b0859e87eae619f7d88fcd88333eAffected
2562756dde550901c224e3805102bdfc17e7d13a to before aa9dde93e05a837645fdfd577eea71f0733f0694Affected

LinuxLinux

4.8Affected
before 4.8Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.55 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.