‹ Volver al listado

CVE-2026-98501

Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.21 %mayor que el 11 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado

En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:

HID: alps: corrige el use-after-free en el fallo de registro de input2

alps_input_configured() almacena data->input2 antes de llamar a input_register_device(). Si el registro falla, input_free_device() libera el dispositivo de entrada, pero data->input2 sigue apuntando a la memoria liberada. alps_input_configured() llama a hid_hw_open() antes de reservar input2, por lo que las URB ya están activas y raw_event puede dispararse durante la ventana del fallo. Si llega entonces un informe U1_SP_ABSOLUTE_REPORT_ID, u1_raw_event() desreferencia el data->input2 ya liberado, lo que provoca un use-after-free.

Leer descripción completaMostrar menos

La solución consiste en almacenar input2 en drvdata solo después de un registro correcto y en añadir una comprobación de NULL en la ruta de raw_event.

Traducción automática del texto original de NVD (en inglés).

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días
0.21 %
Percentil entre todas las CVEs puntuadas
11
Fecha de la puntuación
20/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

Mostrar las 8 referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98501",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2562756dde550901c224e3805102bdfc17e7d13a",
              "lessThan": "64f824dccfd316fd3db8ea1cc4e8a76ad6a02740",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2562756dde550901c224e3805102bdfc17e7d13a",
              "lessThan": "2e55d76e6e8a756f6d87c241de975599f82b02fa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2562756dde550901c224e3805102bdfc17e7d13a",
              "lessThan": "ef8ca5bb4c8b9696f38b1bebce1c851baa02b77b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2562756dde550901c224e3805102bdfc17e7d13a",
              "lessThan": "5a8ad63158165bacd6a1d7420e0fe5364c913b06",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2562756dde550901c224e3805102bdfc17e7d13a",
              "lessThan": "47e5e177e9e4e10da6f2759d5ce8d049e33efdc4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2562756dde550901c224e3805102bdfc17e7d13a",
              "lessThan": "925da1d2a24787f24872de13a4680437c54de179",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2562756dde550901c224e3805102bdfc17e7d13a",
              "lessThan": "443f6b93442b10b972a16f57ceaaea75b77892b6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2562756dde550901c224e3805102bdfc17e7d13a",
              "lessThan": "d3aba3442798ce4a4c8ce3104d7b286d61e605f9",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/hid/hid-alps.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.8",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/hid/hid-alps.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-18T16:17:01.143",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2e55d76e6e8a756f6d87c241de975599f82b02fa",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/443f6b93442b10b972a16f57ceaaea75b77892b6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/47e5e177e9e4e10da6f2759d5ce8d049e33efdc4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5a8ad63158165bacd6a1d7420e0fe5364c913b06",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/64f824dccfd316fd3db8ea1cc4e8a76ad6a02740",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/925da1d2a24787f24872de13a4680437c54de179",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d3aba3442798ce4a4c8ce3104d7b286d61e605f9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ef8ca5bb4c8b9696f38b1bebce1c851baa02b77b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: alps: fix use-after-free on input2 registration failure\n\nalps_input_configured() stores data->input2 before calling\ninput_register_device().  If registration fails, input_free_device()\nfrees the input device but data->input2 still points to the freed memory.\nalps_input_configured() calls hid_hw_open() before allocating input2, so\nURBs are already active and raw_event can fire during the failure window.\nA U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event()\nto dereference the freed data->input2 -> use-after-free.\n\nFix by only storing input2 into drvdata after successful registration\nand adding a NULL guard in the raw_event path."
    }
  ],
  "lastModified": "2026-10-19T10:19:03.210",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}