Critical NULL Pointer Dereference in Linux Kernel HID Driver - CVE-2026-31625
Summary
DEBIAN-CVE-2026-31625: In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix NULL pointer dereference in alps_raw_event() Commit ecfa6f34492c ("HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them"... Affects linux versions 5.10.103-1 – 7.0.1-1~exp1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It includes various drivers, including the Human Interface Device (HID) drivers, which facilitate communication between the operating system and input devices like keyboards and mice. The vulnerability in question affects the alps driver, which is responsible for handling input from certain touchpads and pointing devices. This vulnerability could lead to system instability or crashes if exploited.
Vulnerability Detail
In the Linux kernel, a NULL pointer dereference vulnerability was identified in the alps_raw_event() function of the HID alps driver. This issue arose from a missed fix in previous commits that aimed to prevent such dereferences in HID drivers. If the driver does not properly check whether it has been claimed before processing raw events, it can lead to a crash or unexpected behavior, potentially allowing an attacker to exploit this flaw to disrupt system operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it becomes available.
Conclusion
CVE-2026-31625 is a critical vulnerability affecting the Linux kernel's HID alps driver, which can lead to system crashes due to a NULL pointer dereference. Users are strongly encouraged to update their systems to the latest kernel version to mitigate this risk. Regular monitoring using tools like Vulert can help maintain awareness of vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2026-31625 is a vulnerability in the Linux kernel's HID alps driver that can lead to a NULL pointer dereference, potentially causing system crashes.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability could lead to system instability, crashes, or unauthorized access, depending on how the system is configured and used.
Yes, a patch has been developed and users should update their Linux kernel to the latest version to mitigate this vulnerability.
While there are no specific workarounds, it is crucial to prioritize updating your kernel as soon as possible to protect against potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
