The vulnerability resides in the Linux kernel HID alps driver, where a second input device—called the DualPoint Stick—is allocated and registered without a corresponding removal routine. When the main device is removed, the driver’s default removal routine iterates only over the primary input device list, leaving the secondary device registered. This oversight causes a memory and resource leak each time a DualPoint Stick device is detached. The leak does not directly expose data but can exhaust kernel resources over time, potentially degrading system responsiveness or causing a denial of service via resource exhaustion. This issue represents a memory leak (CWE-401) that can lead to denial of service (CWE-400).

All Linux kernel builds that include the alps HID driver and support DualPoint Stick devices are impacted. The bug exists in the kernel core, not vendor‑specific patches, and applies universally to any distribution that ships with the affected kernel version. Specifically, Linux kernels before the commit that added a proper .remove handler for alps devices are vulnerable.

Without a removal handler, the kernel leaks memory for each detach event. While the CVSS score and EPSS information are not presently available, the absence of cleanup can lead to cumulative resource consumption. Because the flaw is in kernel code that runs with elevated privileges, a local user or any entity capable of driving a DualPoint Stick can repeatedly attach and detach it to exacerbate the leak. The vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation attempts in the wild. Nonetheless, the low barrier to trigger and the potential for DoS warrants immediate remediation.