CVE-2026-98502: Linux Kernel HID Alps Privilege Escalation

CVE-2026-98502 Overview

CVE-2026-98502 is a Linux kernel vulnerability in the Human Interface Device (HID) alps driver. The driver allocates a secondary input device named DualPoint Stick through alps_input_configured() but never unregisters it on device removal. The alps_driver struct lacks a .remove handler, and the second input device is not tracked in hdev->inputs. As a result, the default removal path through hid_hw_stop and hidinput_disconnect only iterates hdev->inputs and leaks the second input device on every removal. The fix adds a .remove handler that stops the device before unregistering the secondary input to prevent URB callbacks from touching freed memory.

Critical Impact
Repeated connect and disconnect cycles of affected ALPS HID devices leak kernel memory, degrading system stability over time.

Affected Products

Linux kernel HID subsystem (drivers/hid/hid-alps.c)
Systems using ALPS DualPoint Stick input devices via the HID alps driver
Multiple stable kernel branches referenced by upstream backport commits

Discovery Timeline

2026-10-18 - CVE-2026-98502 published to the National Vulnerability Database (NVD)
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98502

Vulnerability Analysis

The HID alps driver supports ALPS pointing devices that expose both a touchpad and a secondary pointing stick. During probe, alps_input_configured() allocates a second input device via input_allocate_device() and registers it with the input subsystem. However, the driver stores this pointer only in private driver data, not in the HID core's hdev->inputs list.

When the device is removed, the HID core invokes hid_hw_stop(), which calls hidinput_disconnect(). That function iterates hdev->inputs and unregisters each tracked input device. Because the DualPoint Stick device lives outside this list, the kernel never unregisters or frees it. Each unplug or driver unbind event leaks the associated kernel structures.

Root Cause

The root cause is a missing .remove callback in the alps_driver structure combined with incomplete bookkeeping of allocated input devices [CWE-401: Missing Release of Memory after Effective Lifetime]. The driver uses a side-channel allocation but does not provide the symmetric teardown required by the HID input lifecycle.

Attack Vector

Triggering the leak requires repeated attach and detach events of a supported ALPS HID device. Physical access or control of a USB-attached device accelerates the leak. There is no indication of remote exploitability or privilege escalation. The practical impact is resource exhaustion on long-running systems that repeatedly bind and unbind the driver.

The upstream patch introduces a .remove handler that first calls hid_hw_stop() to quiesce URB callbacks that may still reference the secondary input, then calls input_unregister_device() on the tracked pointer. See the fix in Kernel Git Commit aa9dde and the backports in Kernel Git Commit 1170ebf, Kernel Git Commit 978e80, Kernel Git Commit aa4845, and Kernel Git Commit bd9571.

Detection Methods for CVE-2026-98502

Indicators of Compromise

Growing kmalloc slab usage attributable to input_dev allocations after repeated ALPS device plug and unplug cycles.
Kernel memory accounting in /proc/slabinfo showing unbounded growth of input-related caches on systems using the hid-alps driver.
dmesg entries recording multiple registrations of DualPoint Stick input devices without corresponding unregister messages.

Detection Strategies

Audit loaded kernel versions against the fixed commits listed in the vendor advisory URLs to confirm whether the backport is present.
Monitor long-lived endpoints that frequently reattach ALPS devices, such as docking-station workflows, for slow memory growth over time.
Use kernel memory leak detection tools such as kmemleak on test systems to confirm the presence of the leaked allocation.

Monitoring Recommendations

Track MemAvailable and slab metrics on fleet endpoints to flag gradual degradation consistent with kernel leaks.
Collect dmesg and HID subsystem telemetry via the endpoint agent for central correlation and version attribution.
Alert when kernel versions on managed Linux hosts fall behind the patched stable release lines.

How to Mitigate CVE-2026-98502

Immediate Actions Required

Update affected Linux hosts to a kernel build that includes the upstream fix or the stable backports referenced in the external commits.
Where patching is delayed, unload the hid-alps module on systems that do not require ALPS DualPoint Stick support using modprobe -r hid_alps.
Inventory endpoints that use ALPS HID hardware to prioritize patch rollout.

Patch Information

The fix adds a .remove handler to the alps_driver struct that calls hid_hw_stop() followed by input_unregister_device() for the secondary input device. Apply the mainline commit Kernel Git Commit aa9dde or the appropriate stable backport for your kernel branch.

Workarounds

Blacklist the hid_alps module on systems without ALPS DualPoint hardware to eliminate exposure.
Reboot long-running systems periodically to reclaim leaked kernel memory until patches are deployed.
Restrict physical USB access on sensitive endpoints to reduce opportunities for repeated attach and detach cycles.

bash

# Configuration example: blacklist the hid_alps module until patched
echo "blacklist hid_alps" | sudo tee /etc/modprobe.d/blacklist-hid-alps.conf
sudo modprobe -r hid_alps
sudo update-initramfs -u