CVE-2026-99069

In the Linux kernel, the following vulnerability has been resolved:

Input: ati remote2 - fix type confusion in device attribute handlers

Previously, the channel mask and mode mask attributes were registered on the parent usb device via sysfs create group(). When commit b20d6bf8014b ("Input: ati-remote2 - use driver core to instantiate device attributes") converted the driver to let the driver core manage them via dev groups in struct usb driver, the attributes moved to the bound usb interface devices, but the show and store callbacks were not updated accordingly.

As a result, the callbacks still invoked to usb device() on a device pointer belonging to a struct usb interface, producing an invalid usb device pointer.

Use to usb interface() directly in the attribute handlers to obtain the interface and its driver data.