Executive brief
A vulnerability in the Linux kernel's ALPS input driver could allow a local user to crash the system. The issue occurs when the system processes input events from certain hardware devices like touchpads before they are fully initialized. This results in a system crash (denial of service), potentially disrupting operations on affected laptops or workstations.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel HID (Human Interface Device) subsystem within the ALPS driver (hid-alps.c). The root cause is a missing check for the HID_CLAIMED_INPUT guard in the alps_raw_event() callback. If a raw event is processed before the device has been properly claimed or if the input device structure is not initialized, the kernel attempts to dereference a NULL pointer. A local attacker could potentially trigger this condition to cause a kernel oops and subsequent denial of service. Patches have been released across multiple stable kernel branches to implement the necessary state checks.
Affected products
- Linux Linux Kernel 4.15 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
- 2026-04-09: patched: Initial patch committed to maintainer tree
References
- https://git.kernel.org/stable/c/0091dfa542a362c178a7e9393097138a57d327d1
- https://git.kernel.org/stable/c/1badfc4319224820d5d890f8eab6aa52e4e83339
- https://git.kernel.org/stable/c/4b618248d2307a219d9431a730cfe1156c8e3386
- https://git.kernel.org/stable/c/56850666bb5dcf7a13d76c5d02864813e17ee537
- https://git.kernel.org/stable/c/72516a8d7fe247fd895424bab87952f105a0c255
- https://git.kernel.org/stable/c/8eed7bce7a4c41ab28ee4891103623a12fd41611
- https://git.kernel.org/stable/c/c8cc765253ad89ccc106a7bdeb5aeac6cf963078