CVE-2026-98859: Linux Kernel HID Multitouch UAF Vulnerability

CVE-2026-98859 Overview

CVE-2026-98859 is a use-after-free vulnerability in the Linux kernel's HID multitouch driver (hid-multitouch). The flaw resides in mt_remove(), which calls timer_delete_sync() on the sticky-finger release_timer before stopping the hardware. Because the transport can still deliver reports after the sync returns, the report path rearms the timer via mod_timer(). The driver's td structure is allocated with devm_kzalloc() and freed when the driver unbinds, so the queued timer later dereferences freed memory in mt_expired_timeout().

Critical Impact
A race between device removal and incoming HID reports can trigger a kernel-mode use-after-free, leading to memory corruption or denial of service on systems using multitouch input devices.

Affected Products

Linux kernel builds containing the hid-multitouch driver prior to the fix commits
Distributions shipping the vulnerable drivers/hid/hid-multitouch.c with sticky-finger quirk handling
Systems exposing HID multitouch devices (USB, Bluetooth, I2C-HID) subject to hot-unbind events

Discovery Timeline

2026-10-18 - CVE-2026-98859 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98859

Vulnerability Analysis

The hid-multitouch driver maintains a release_timer to clear stuck touch contacts when the MT_QUIRK_STICKY_FINGERS quirk is active. During driver teardown, mt_remove() quiesces this timer before tearing down sysfs and stopping the hardware. The teardown sequence calls timer_delete_sync(&td->release_timer) followed by sysfs_remove_group() and hid_hw_stop().

timer_delete_sync() waits for any running callback and dequeues the timer, but it does not prevent future arming. The HID transport continues delivering reports until hid_hw_stop() executes. When a report arrives in the small window after the sync but before hardware stop, the report path executes mod_timer(&td->release_timer, jiffies + msecs_to_jiffies(100)), requeuing the timer.

After mt_remove() returns, the device-managed td structure is freed. When the queued timer eventually fires, mt_expired_timeout() dereferences the freed td through timer_container_of() and accesses td->hdev and td->mt_io_flags. This is a classic use-after-free in kernel context.

Root Cause

The root cause is incorrect timer-shutdown semantics during driver unbind. timer_delete_sync() guarantees no concurrent callback but permits later rearming. Simply reordering the teardown fails because mt_expired_timeout() calls mt_release_contacts(), which walks hdev->inputs; the timer must therefore be fully stopped before hid_hw_stop() dismantles input devices.

Attack Vector

Exploitation requires a race between HID report delivery and driver unbind. A local attacker or a malicious or malfunctioning HID peripheral can trigger device removal (unplug, hub reset, driver rebind via sysfs) while generating multitouch reports. The resulting kernel use-after-free can cause system instability, panic, or potentially memory corruption suitable for privilege escalation.

See the upstream fix for the patched teardown pattern: Kernel Commit 0c19a6c.

Detection Methods for CVE-2026-98859

Indicators of Compromise

Kernel oops or panic referencing mt_expired_timeout, mt_release_contacts, or hid-multitouch in the stack trace
KASAN reports flagging use-after-free in drivers/hid/hid-multitouch.c around the release_timer callback
Unexpected system crashes correlated with hot-unplug of USB or Bluetooth multitouch peripherals

Detection Strategies

Enable CONFIG_KASAN and CONFIG_DEBUG_OBJECTS_TIMERS on test kernels to surface the UAF and timer-use-after-free conditions
Monitor /var/log/kern.log and dmesg for HID driver stack traces during device unbind operations
Audit running kernel version against the stable commits listed in the vendor references to identify unpatched hosts

Monitoring Recommendations

Collect kernel crash dumps and forward to a centralized log pipeline for correlation with device enumeration events
Track udev remove events for HID devices paired with subsequent kernel exceptions
Alert on repeated unbind or rebind cycles targeting hid-multitouch in sysfs, which may indicate attempted exploitation

How to Mitigate CVE-2026-98859

Immediate Actions Required

Apply the upstream fix that replaces timer_delete_sync() with timer_shutdown_sync() in mt_remove()
Update to the stable kernel release containing the referenced commits from kernel.org
Restrict physical and administrative access that permits attaching untrusted HID devices or triggering driver unbinds

Patch Information

The fix uses timer_shutdown_sync(), which both quiesces the timer and makes any later mod_timer() a no-op, resolving the race without requiring teardown reordering. Patched trees include the following commits: Kernel Commit 0c19a6c, Kernel Commit 1f1bd9a, Kernel Commit 3776f34, Kernel Commit 5acb2da, and Kernel Commit a0125ca.

Workarounds

Blacklist the hid-multitouch module on systems that do not require multitouch input until a patched kernel is installed
Disable USB autosuspend and avoid programmatic unbinding of multitouch devices via sysfs on vulnerable hosts
Apply vendor-provided kernel live patches where available to close the window pending full reboot

bash

# Blacklist the hid-multitouch driver until a patched kernel is deployed
echo "blacklist hid_multitouch" | sudo tee /etc/modprobe.d/blacklist-hid-multitouch.conf
sudo rmmod hid_multitouch
sudo update-initramfs -u