Medium 5.5Published Apr 24, 2026

CVE-2026-31625HID: alps: fix NULL pointer dereference in alps_raw_event()

Updated under an hour ago (Oct 28, 2026, 12:30 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix NULL pointer dereference in alps_raw_event() Commit ecfa6f34492c ("HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them") attempted to fix up the HID drivers that had missed the previous fix that was done in 2ff5baa9b527 ("HID: appleir: Fix potential NULL dereference at raw event handle"), but the alps driver was missed. Fix this up by properly checking in the hid-alps driver that it had been claimed correctly before attempting to process the raw event.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 73196ebe134d11a68a2e27814c489d685cfc8b03 before 56850666bb5dcf7a13d76c5d02864813e17ee537; 73196ebe134d11a68a2e27814c489d685cfc8b03 builds before 72516a8d7fe247fd895424bab87952f105a0c255; from 73196ebe134d11a68a2e27814c489d685cfc8b03 before cc411e4823d8bfa23327d9989a0fa4e0ce76aebe; from 73196ebe134d11a68a2e27814c489d685cfc8b03 before c8cc765253ad89ccc106a7bdeb5aeac6cf963078; 73196ebe134d11a68a2e27814c489d685cfc8b03 builds before 8eed7bce7a4c41ab28ee4891103623a12fd41611; 73196ebe134d11a68a2e27814c489d685cfc8b03 builds before 0091dfa542a362c178a7e9393097138a57d327d1; 73196ebe134d11a68a2e27814c489d685cfc8b03 builds before 4b618248d2307a219d9431a730cfe1156c8e3386; from 73196ebe134d11a68a2e27814c489d685cfc8b03 before ee2cb3ddfdca949dbc0c3f796ed5a439f0efc9f6; and 1 more ranges	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.15 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; from 7.0 before 7.0.1	NVD

References

References

https://git.kernel.org/stable/c/56850666bb5dcf7a13d76c5d02864813e17ee537
https://git.kernel.org/stable/c/72516a8d7fe247fd895424bab87952f105a0c255
https://git.kernel.org/stable/c/cc411e4823d8bfa23327d9989a0fa4e0ce76aebe
https://git.kernel.org/stable/c/c8cc765253ad89ccc106a7bdeb5aeac6cf963078	patch
https://git.kernel.org/stable/c/8eed7bce7a4c41ab28ee4891103623a12fd41611	patch
https://git.kernel.org/stable/c/0091dfa542a362c178a7e9393097138a57d327d1	patch
https://git.kernel.org/stable/c/4b618248d2307a219d9431a730cfe1156c8e3386	patch
https://git.kernel.org/stable/c/ee2cb3ddfdca949dbc0c3f796ed5a439f0efc9f6	patch
https://git.kernel.org/stable/c/1badfc4319224820d5d890f8eab6aa52e4e83339	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.