Bug 2461470 (CVE-2026-31625) - CVE-2026-31625 kernel: HID: alps: fix NULL pointer dereference in alps_raw_event()
Summary: CVE-2026-31625 kernel: HID: alps: fix NULL pointer dereference in alps_raw_ev...
Keywords:
Status: NEW
Alias: CVE-2026-31625
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-24 15:03 UTC by OSIDB Bzimport
Modified: 2026-04-24 20:32 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-04-24 15:03:19 UTC 
In the Linux kernel, the following vulnerability has been resolved:

HID: alps: fix NULL pointer dereference in alps_raw_event()

Commit ecfa6f34492c ("HID: Add HID_CLAIMED_INPUT guards in raw_event
callbacks missing them") attempted to fix up the HID drivers that had
missed the previous fix that was done in 2ff5baa9b527 ("HID: appleir:
Fix potential NULL dereference at raw event handle"), but the alps
driver was missed.

Fix this up by properly checking in the hid-alps driver that it had been
claimed correctly before attempting to process the raw event.
Comment 1 Keith Grant 2026-04-24 20:30:25 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026042427-CVE-2026-31625-71c1@gregkh/T
Note You need to log in before you can comment on or make changes to this bug.