In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove… (CVE-2026-98502)

The Linux kernel HID alps driver allocated a second input device called 'DualPoint Stick' using input_allocate_device() and registered it, but lacked a .remove handler in the alps_driver struct. Because input2 was not tracked in hdev->inputs, the default remove path did not unregister this second device, causing it to leak on every device removal. The vulnerability was resolved by adding a .remove handler that stops the device first to prevent URB callbacks during teardown and then unregisters the second input device, preventing resource leaks.

The vulnerability causes a resource leak of the second input device on every device removal, which could lead to resource exhaustion or instability in the system over time. There is no indication of direct security compromise or code execution from the provided data.

A fix is available that adds a proper .remove handler to the alps_driver struct to stop and unregister the second input device. Users should update to the patched Linux kernel version containing this fix. No other mitigation steps are indicated.