{"id":"CVE-2026-98502","published":"2026-10-18T16:17:01.260","lastModified":"2026-10-19T10:19:03.373","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: alps: unregister DualPoint Stick input device on remove\n\nalps_input_configured() allocates a second input device (\"DualPoint\nStick\") with input_allocate_device() and registers it, but the\nalps_driver struct has no .remove handler and input2 is not tracked in\nhdev->inputs.  The default remove path (hid_hw_stop -> hidinput_disconnect)\nonly iterates hdev->inputs, so input2 is never unregistered and leaks\non every device removal.\n\nAdd a .remove handler that stops the device first (preventing URB\ncallbacks from touching input2 during teardown) and then unregisters\ninput2.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/1170ebfba562b3938ff7749b2e42e4420f19436d","tags":[]},{"url":"https://git.kernel.org/stable/c/978e801750c7b0859e87eae619f7d88fcd88333e","tags":[]},{"url":"https://git.kernel.org/stable/c/aa4845a710ae9fee6a3831f5c338904cea77c3aa","tags":[]},{"url":"https://git.kernel.org/stable/c/aa9dde93e05a837645fdfd577eea71f0733f0694","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}