CVE-2026-98859: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98859 is a use-after-free vulnerability in the Linux kernel's HID multitouch driver (drivers/hid/hid-multitouch.c), specifically in the release timer handling during device removal. When mt_remove() calls timer_delete_sync() to quiesce the sticky-finger timer, incoming HID reports can re-arm the timer after the sync completes but before hid_hw_stop() finishes; when the timer subsequently fires, mt_expired_timeout() dereferences the already-freed mt_device structure (td). The vulnerability affects Linux kernel versions from 4.13 up to (but not including) the patched stable commits across multiple stable branches. It carries a CVSS category estimate of Medium (GitHub Advisory, Feedly).

The root cause is a use-after-free (CWE-416) race condition in the HID multitouch driver's device teardown path. timer_delete_sync() dequeues the release_timer and waits for any running callback, but does not prevent subsequent mod_timer() calls; if a HID report with the MT_QUIRK_STICKY_FINGERS quirk and active slots arrives after timer_delete_sync() returns, the report handler re-arms the timer via mod_timer(&td->release_timer, jiffies + msecs_to_jiffies(100)). Because td is allocated with devm_kzalloc() against hdev->dev, it is freed when the driver unbinds after mt_remove() returns. The fix replaces timer_delete_sync() with timer_shutdown_sync(), which additionally makes any subsequent mod_timer() a no-op, eliminating the race without requiring reordering of teardown steps (GitHub Advisory).

Successful exploitation can result in kernel memory corruption or arbitrary code execution with kernel privileges on the affected system. A local attacker who can trigger HID multitouch device reports — either by physically interacting with a touchscreen or by sending crafted HID packets — during device removal can cause the freed td structure to be dereferenced, potentially allowing privilege escalation to ring-0. The impact is confined to the local system; however, kernel-level code execution could enable full system compromise, disabling security controls, or facilitating further lateral movement (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). Exploitation requires local access and the ability to time HID report delivery to coincide with device removal, making it a race condition that is non-trivial to reliably trigger. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS score data is not yet available for this CVE.

1. Gain local access: Obtain a local user session on a Linux system running a vulnerable kernel (4.13 through the unpatched stable versions) with a HID multitouch device (e.g., touchscreen) that uses the MT_QUIRK_STICKY_FINGERS quirk.
2. Prepare HID report delivery: Set up a mechanism to continuously send or trigger HID multitouch reports with active touch slots to the target device, either via physical interaction with the touchscreen or by crafting HID packets using a tool such as a USB gadget or /dev/hidraw.
3. Trigger device removal: Initiate unbinding of the HID multitouch driver (e.g., via echo <device> > /sys/bus/hid/drivers/hid-multitouch/unbind or by physically disconnecting the device) to invoke mt_remove().
4. Race the timer: Ensure a HID report arrives after timer_delete_sync() completes but before hid_hw_stop() finishes, causing mod_timer() to re-arm release_timer with the soon-to-be-freed td pointer.
5. Trigger use-after-free: Allow the timer to fire after td has been freed by devm cleanup; mt_expired_timeout() dereferences the freed memory, potentially enabling controlled kernel memory corruption or code execution with kernel privileges (GitHub Advisory, Feedly).

• Logs: Kernel oops or BUG messages in dmesg or /var/log/kern.log referencing mt_expired_timeout, hid-multitouch, or use-after-free/invalid memory access during HID device removal.
• Logs: Kernel KASAN (Kernel Address Sanitizer) reports indicating use-after-free in mt_expired_timeout() or mt_release_contacts() if KASAN is enabled on the system.
• Process: Unexpected kernel panics or system instability coinciding with HID multitouch device unbind/removal events.
• File System: Crash dump files (e.g., /var/crash/, kdump artifacts) generated around the time of HID device removal that reference the multitouch driver stack.

Apply the upstream kernel fix that replaces timer_delete_sync() with timer_shutdown_sync() in mt_remove(), which prevents the timer from being re-armed after teardown begins. Patched commits are available for multiple stable branches: 1f1bd9a3117f and 0c19a6c1d25f (two branches), a0125ca86e40, and 5acb2dace582f; unaffected stable versions include 6.12.113+, 6.18.56+, 7.2.10+, and 7.3-rc6+ (GitHub Advisory). As an interim workaround on systems where patching is not immediately possible, physically disconnect or disable the affected HID multitouch device if it is not required for operation (Feedly).