In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: stop the release timer from being rearmed on remove mt_remove()… (CVE-2026-98859)

The Linux kernel HID multitouch driver had a flaw where the release timer was deleted using timer_delete_sync(), which waits for running callbacks and dequeues the timer but does not prevent it from being rearmed. Because the transport layer could still deliver reports that rearmed the timer after deletion, the timer could fire after the associated memory was freed, causing a use-after-free scenario. The fix involves using timer_shutdown_sync(), which prevents any subsequent rearming of the timer, ensuring safe teardown without race conditions or use-after-free risks.

This vulnerability could lead to a use-after-free condition in the kernel, potentially causing system instability or crashes. The description does not specify exploitation in the wild or privilege escalation, so the impact is limited to kernel memory safety and stability concerns.

A fix is available that replaces timer_delete_sync() with timer_shutdown_sync() in the HID multitouch driver to properly quiesce the release timer and prevent it from being rearmed after teardown. Users should apply the updated Linux kernel version containing this fix once it is released. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.