A use-after-free flaw exists in the Linux kernel when the alps HID driver fails to register its second input device. The driver frees the device but leaves a dangling pointer. During the failure window, the device can still receive raw reports, which causes an event handler to dereference the freed memory. The resulting memory corruption can crash the kernel or may be leveraged by an attacker to execute arbitrary code with kernel privileges.

All Linux kernel installations that include the alps HID driver are affected. No specific version numbers were supplied, so any kernel containing the vulnerable driver implementation is at risk.

The CVSS and EPSS metrics are not provided, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw occurs in kernel space, a local attacker who can supply a malicious HID device can trigger the use‑after‑free, potentially leading to a denial of service or escalation of privileges. The exploit requires direct interaction with the device and does not rely on network or remote input, making local exploitation the most likely attack vector.