CVE-2026-31625 Overview
CVE-2026-31625 is a NULL pointer dereference vulnerability in the Linux kernel's HID (Human Interface Device) alps driver. The flaw resides in the alps_raw_event() callback, which processes raw HID events without first confirming the device was claimed by an input handler. A prior remediation effort in commit ecfa6f34492c added HID_CLAIMED_INPUT guards to several raw_event callbacks but omitted the hid-alps driver. The fix adds the missing claim check before processing raw events, preventing dereference of an uninitialized input pointer.
Critical Impact
A local attacker with the ability to deliver crafted HID reports through an Alps device can trigger a kernel NULL pointer dereference, causing a denial-of-service condition on the affected system.
Affected Products
- Linux Kernel (multiple stable branches prior to the fixing commits)
- Distributions shipping the hid-alps driver
- Systems with Alps HID-compatible input peripherals
Discovery Timeline
- 2026-04-24 - CVE-2026-31625 published to NVD
- 2026-04-27 - Last updated in NVD database
Technical Details for CVE-2026-31625
Vulnerability Analysis
The Linux HID subsystem dispatches raw input reports to driver-specific raw_event callbacks. These callbacks frequently depend on input device state that is only initialized once HID core sets the HID_CLAIMED_INPUT flag. When the flag is absent, internal pointers referenced by the callback remain NULL.
The hid-alps driver's alps_raw_event() function processed incoming reports without verifying claim status. Commit 2ff5baa9b527 introduced the canonical pattern in the appleir driver, and commit ecfa6f34492c propagated it to other drivers. The alps driver was skipped in that sweep, leaving the dereference path reachable.
The condition is classified as [CWE-476] NULL Pointer Dereference. Successful triggering halts kernel execution on the affected code path, producing a kernel oops or panic depending on system configuration.
Root Cause
The root cause is a missing input-claim guard in alps_raw_event(). The handler assumed the input device had been bound to the HID device before raw events arrived. When binding fails or has not completed, accessing the associated input structures dereferences a NULL pointer.
Attack Vector
Exploitation requires local access and the ability to present a HID device that the hid-alps driver will bind. An attacker with physical access can connect a crafted USB or Bluetooth peripheral that advertises matching identifiers. A local user with permissions to inject HID reports through uhid or similar interfaces could also reach the vulnerable callback. Remote exploitation is not feasible.
No public proof-of-concept exploit is available. The vulnerability impact is limited to availability — confidentiality and integrity are not affected.
Detection Methods for CVE-2026-31625
Indicators of Compromise
- Kernel oops or panic entries in dmesg or journalctl -k referencing alps_raw_event in the call trace
- Unexpected system reboots or crashes coinciding with insertion or reconnection of HID input devices
- Repeated HID device bind or unbind events for vendor identifiers handled by hid-alps
Detection Strategies
- Inventory running kernel versions across endpoints and compare against the fixing commits listed in the kernel.org references
- Monitor kernel ring buffer logs for BUG: kernel NULL pointer dereference signatures involving HID subsystem symbols
- Audit udev and HID subsystem events for anomalous device attachments preceding crashes
Monitoring Recommendations
- Forward /var/log/kern.log and journalctl kernel events to a centralized log platform for correlation
- Alert on processes or sessions that programmatically open /dev/uhid outside of expected administrative workflows
- Track HID device enumeration events in environments where peripheral hardware should be static
How to Mitigate CVE-2026-31625
Immediate Actions Required
- Update to a Linux kernel build that includes one of the upstream fix commits referenced on git.kernel.org
- Apply distribution vendor kernel updates that backport the hid-alps claim-check fix
- On servers and kiosks without Alps input hardware, blacklist the hid-alps module to remove the attack surface
- Restrict physical access to systems where untrusted USB or Bluetooth peripherals could be connected
Patch Information
The issue is resolved in the mainline Linux kernel and backported across stable branches. Reference commits include Kernel Git Commit 0091dfa, Kernel Git Commit 1badfc4, Kernel Git Commit 4b61824, Kernel Git Commit 8eed7bc, Kernel Git Commit c8cc765, and Kernel Git Commit ee2cb3d. The fix adds a HID_CLAIMED_INPUT check in alps_raw_event() before processing the event.
Workarounds
- Blacklist the hid-alps kernel module on systems that do not require Alps input device support
- Restrict access to /dev/uhid and similar HID-injection interfaces using udev rules and capability restrictions
- Disable unused USB and Bluetooth ports on production systems via firmware or operating system controls
# Blacklist the hid-alps module to remove the vulnerable code path
echo "blacklist hid-alps" | sudo tee /etc/modprobe.d/blacklist-hid-alps.conf
sudo rmmod hid_alps 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
