CVE-2026-98501

In the Linux kernel, the following vulnerability has been resolved:

HID: alps: fix use-after-free on input2 registration failure

alps input configured() stores data->input2 before calling input register device(). If registration fails, input free device() frees the input device but data->input2 still points to the freed memory. alps input configured() calls hid hw open() before allocating input2, so URBs are already active and raw event can fire during the failure window. A U1 SP ABSOLUTE REPORT ID report arriving then causes u1 raw event() to dereference the freed data->input2 -> use-after-free.

Fix by only storing input2 into drvdata after successful registration and adding a NULL guard in the raw event path.