CVE-2026-98501

A flaw was found in the Linux kernel's Alps Human Interface Device (HID) driver. If registration of an input device fails during configuration, the driver frees the device memory while communication channels are already active, leaving a dangling reference. An attacker capable of attaching a malicious device or sending crafted input reports can trigger a use-after-free condition during this failure window. This flaw primarily results in a Denial of Service (DoS) through a kernel crash, and may potentially allow arbitrary code execution.

This vulnerability is rated as Moderate because exploitation requires either physical access to attach an Alps Human Interface Device or access to a virtual environment capable of emulating it. In standard Red Hat Enterprise Linux server and enterprise cloud deployments, Alps input devices are typically absent. In addition, triggering the condition depends on a specific device registration failure during initialization, leading to high attack complexity and limiting the potential risk primarily to a localized denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.