CVE-2026-98859 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should review and apply the provided patches to prevent potential use-after-free conditions. They should also verify Linux kernel versions and patches, and monitor the Linux kernel's HID multitouch driver for potential use-after-free conditions.

Why it matters

A use-after-free vulnerability exists in the Linux kernel's HID multitouch driver, potentially leading to denial of service or code execution. Linux kernel developers and maintainers should review and apply the provided patches to prevent potential use-after-free conditions.

• Potential use-after-free condition leading to denial of service or code execution
• Requires verification of Linux kernel versions and patches
• Remediation priority for Linux kernel developers and maintainers

Technical summary

The Linux kernel's HID multitouch driver has a use-after-free vulnerability. The mt_remove() function quiesces the sticky-finger timer before stopping the hardware, but it does not stop the timer from being armed again. A report that arrives after timer_delete_sync() has returned leaves the timer queued. When the timer fires afterwards, mt_expired_timeout() dereferences the freed td. The vulnerability has a medium defensive priority and requires verification of Linux kernel versions and patches. The remediation priority is high for Linux kernel developers and maintainers.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor the Linux kernel's HID multitouch driver for potential use-after-free conditions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The Linux kernel's HID multitouch driver has a use-after-free vulnerability. The mt_remove() function quiesces the sticky-finger timer before stopping the hardware, but it does not stop the timer from being armed again. A report that arrives after timer_delete_sync() has returned leaves the timer queued. When the timer fires afterwards, mt_expired_timeout() dereferences the freed td.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.