Multitouch Vulnerability in Linux Kernel Affecting HID Devices

CVE-2026-98859

What is CVE-2026-98859?

A vulnerability in the Linux kernel's multitouch handling code allows for improper timer management upon device removal. Specifically, when the hardware is stopped, the release timer can incorrectly be rearmed due to an asynchronous report delivery, leading to the dereferencing of a freed memory structure. This flaw can compromise system stability and security, as it may cause unintended behavior in HID devices, posing risks for applications relying on these inputs. Resolution requires implementing the timer_shutdown_sync() function to ensure a robust teardown process.

References