CVE-2026-99069

A flaw was found in the Linux kernel's ati_remote2 input driver. A local user can exploit this type confusion vulnerability to cause a Denial of Service (DoS). The issue occurs because the driver's device attribute handlers improperly treat an interface pointer as a parent device pointer. By interacting with the affected sysfs device attributes, a local user can trigger an invalid pointer dereference, leading to a system crash.

This vulnerability is rated Moderate because exploitation requires local access and is limited to causing a denial of service without compromising confidentiality or integrity. In Red Hat Enterprise Linux, the ati_remote2 driver is provided as an optional kernel module that is not loaded unless the corresponding USB receiver is attached. Systems without this specialized peripheral connected are not susceptible to this crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.