CVE-2026-98859 - Vulnerability Details

- HID: multitouch: stop the release timer from being rearmed on remove

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: multitouch: stop the release timer from being rearmed on remove

mt_remove() quiesces the sticky-finger timer before stopping the
hardware:

timer_delete_sync(&td->release_timer);

sysfs_remove_group(&hdev->dev.kobj, &mt_attribute_group);
hid_hw_stop(hdev);

timer_delete_sync() waits for a running callback and dequeues the timer,
but it does not stop the timer from being armed again. The transport is
still delivering reports at that point, and the report path rearms it:

if (app->quirks & MT_QUIRK_STICKY_FINGERS) {
if (td->mt_io_flags & MT_IO_SLOTS_MASK)
mod_timer(&td->release_timer,
jiffies + msecs_to_jiffies(100));

A report that arrives after timer_delete_sync() has returned therefore
leaves the timer queued. td is allocated with devm_kzalloc() against
hdev->dev, so it is freed when the driver is unbound, after mt_remove()
returns. When the timer fires afterwards, mt_expired_timeout()
dereferences the freed td:

struct mt_device *td = timer_container_of(td, t, release_timer);
struct hid_device *hdev = td->hdev;

if (test_and_set_bit_lock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags))

Simply moving the teardown after hid_hw_stop() does not fix this on its
own, because mt_expired_timeout() calls mt_release_contacts(), which
walks hdev->inputs; the timer still has to be quiesced before
hid_hw_stop() tears the input devices down.

Use timer_shutdown_sync() instead, which additionally makes any later
mod_timer() a no-op, so neither ordering constraint has to be traded off
against the other. This is the final-teardown pattern the function was
introduced for, and hid-wiimote already uses it for the same reason.

Published: 2026-10-18

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The kernel driver for HID multitouch devices improperly deletes a rearmable timer when the device is removed. The timer deletion routine only waits for the current callback and does not stop future rearm calls. Subsequent HID reports reach the driver, rearm the timer, and when the timer fires after the device has been unbound the timer handler dereferences memory that has already been freed, leading to a use‑after‑free condition. In a kernel context this can corrupt memory or grant an attacker the ability to execute arbitrary code with elevated privileges.

Affected Systems

The flaw exists in the Linux kernel source code. All distributions shipping a kernel that has not yet incorporated the fix are affected, but exact affected version information is not provided in the public data.

Risk and Exploitability

The vulnerability is a classic use‑after‑free (CWE‑416) in kernel space. The CVSS score of 5.3 indicates moderate severity. Exploit complexity is low for an attacker who can interact with HID multitouch hardware. The EPSS score is less than 1%, and the flaw is not listed in the CISA KEV catalog. The attack vector is likely local, though a driver providing a USB or input interface could be used to trigger the flaw remotely if privileged access is already present. The result of exploitation can lead to kernel memory corruption, a system crash, or potential privilege escalation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4f4001bc76fd1a138a501fbd3d68cce72cbf96ce`	affected	< 3776f34fbce990af45978f1628d2e1adc0d67d0f
`4f4001bc76fd1a138a501fbd3d68cce72cbf96ce`	affected	< 1f1bd9a3117f082eb891c0986c4f0e04cd974c9a
`4f4001bc76fd1a138a501fbd3d68cce72cbf96ce`	affected	< 0c19a6c1d25fd5ed66d1f80dc6f6e56cc1f0a787
`4f4001bc76fd1a138a501fbd3d68cce72cbf96ce`	affected	< a0125ca86e405b8a704e96157a6c10ca51087652
`4f4001bc76fd1a138a501fbd3d68cce72cbf96ce`	affected	< 5acb2dace582f061aab5e14c399ac9480315f44b

Linux

affected

Version	Status	Constraints
`4.13`	affected	—
`0`	unaffected	< 4.13
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4f4001bc76fd1a138a501fbd3d68cce72cbf96ce,1f1bd9a3117f082eb891c0986c4f0e04cd974c9a)`	affected	code_commit	—
`[4f4001bc76fd1a138a501fbd3d68cce72cbf96ce,0c19a6c1d25fd5ed66d1f80dc6f6e56cc1f0a787)`	affected	code_commit	—
`[4f4001bc76fd1a138a501fbd3d68cce72cbf96ce,a0125ca86e405b8a704e96157a6c10ca51087652)`	affected	code_commit	—
`[4f4001bc76fd1a138a501fbd3d68cce72cbf96ce,5acb2dace582f061aab5e14c399ac9480315f44b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.13`	affected	generic	—
`[0,4.13)`	unaffected	generic	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that replaces timer_delete_sync with timer_shutdown_sync in mt_remove, ensuring the timer is fully quiesced before device teardown.
Reboot or unload/reload the affected kernel module so that any stale timers are cleared.
If immediate patching is not possible, disable or remove the offending HID multitouch device to prevent the timer from being rearmed.

Generated by OpenCVE AI on October 22, 2026 at 21:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00157.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0c19a6c1d25fd5ed66d1f80dc6f6e56cc1f0a787
https://git.kernel.org/stable/c/1f1bd9a3117f082eb891c0986c4f0e04cd974c9a
https://git.kernel.org/stable/c/3776f34fbce990af45978f1628d2e1adc0d67d0f
https://git.kernel.org/stable/c/5acb2dace582f061aab5e14c399ac9480315f44b
https://git.kernel.org/stable/c/a0125ca86e405b8a704e96157a6c10ca51087652
https://kernelcve.org/list/?q=CVE-2026-98859
https://nvd.nist.gov/vuln/detail/CVE-2026-98859
https://www.cve.org/CVERecord?id=CVE-2026-98859

History

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/3776f34fbce990af45978f1628d2e1adc0d67d0f

Wed, 21 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://kernelcve.org/list/?q=CVE-2026-98859 https://nvd.nist.gov/vuln/detail/CVE-2026-98859 https://www.cve.org/CVERecord?id=CVE-2026-98859
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: stop the release timer from being rearmed on remove mt_remove() quiesces the sticky-finger timer before stopping the hardware: timer_delete_sync(&td->release_timer); sysfs_remove_group(&hdev->dev.kobj, &mt_attribute_group); hid_hw_stop(hdev); timer_delete_sync() waits for a running callback and dequeues the timer, but it does not stop the timer from being armed again. The transport is still delivering reports at that point, and the report path rearms it: if (app->quirks & MT_QUIRK_STICKY_FINGERS) { if (td->mt_io_flags & MT_IO_SLOTS_MASK) mod_timer(&td->release_timer, jiffies + msecs_to_jiffies(100)); A report that arrives after timer_delete_sync() has returned therefore leaves the timer queued. td is allocated with devm_kzalloc() against hdev->dev, so it is freed when the driver is unbound, after mt_remove() returns. When the timer fires afterwards, mt_expired_timeout() dereferences the freed td: struct mt_device td = timer_container_of(td, t, release_timer); struct hid_device hdev = td->hdev; if (test_and_set_bit_lock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags)) Simply moving the teardown after hid_hw_stop() does not fix this on its own, because mt_expired_timeout() calls mt_release_contacts(), which walks hdev->inputs; the timer still has to be quiesced before hid_hw_stop() tears the input devices down. Use timer_shutdown_sync() instead, which additionally makes any later mod_timer() a no-op, so neither ordering constraint has to be traded off against the other. This is the final-teardown pattern the function was introduced for, and hid-wiimote already uses it for the same reason.
Title		HID: multitouch: stop the release timer from being rearmed on remove
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0c19a6c1d25fd5ed66d1f80dc6f6e56cc1f0a787 https://git.kernel.org/stable/c/1f1bd9a3117f082eb891c0986c4f0e04cd974c9a https://git.kernel.org/stable/c/5acb2dace582f061aab5e14c399ac9480315f44b https://git.kernel.org/stable/c/a0125ca86e405b8a704e96157a6c10ca51087652

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:51:20.456Z

Updated: 2026-10-21T12:57:37.465Z

Reserved: 2026-09-25T10:25:14.376Z

Link: CVE-2026-98859

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:40.363

Modified: 2026-10-21T13:21:50.330

Link: CVE-2026-98859

Redhat

Severity : Moderate

Publid Date: 2026-10-18T15:51:20Z

Links: CVE-2026-98859 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-22T21:15:12Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object