---
id: CVE-2026-99069
title: 'Input: ati_remote2 - fix type confusion in device attribute handlers'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Input: ati_remote2 - fix type confusion in device attribute handlers

  Previously, the channel_mask and mode_mask attributes were registered on
  the parent usb_device via…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b20d6bf8014b2d6fcf65c150453d95a6276fd1fa <
    e44ec6b6d3c0b8ea089b589fa0cce49a4da66b89
  - >-
    Linux >= b20d6bf8014b2d6fcf65c150453d95a6276fd1fa <
    d738e51bf2c21921df351f536147178ae3cbd38b
  - >-
    Linux >= b20d6bf8014b2d6fcf65c150453d95a6276fd1fa <
    2caae9d1977beea0a7914b3d86639262801fd116
  - >-
    Linux >= b20d6bf8014b2d6fcf65c150453d95a6276fd1fa <
    f321cc430c49b6c1be0d53f2ef19d8342d8029cc
  - Linux 6.11
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:23:12.396Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99069'
references:
  - url: 'https://git.kernel.org/stable/c/e44ec6b6d3c0b8ea089b589fa0cce49a4da66b89'
  - url: 'https://git.kernel.org/stable/c/d738e51bf2c21921df351f536147178ae3cbd38b'
  - url: 'https://git.kernel.org/stable/c/2caae9d1977beea0a7914b3d86639262801fd116'
  - url: 'https://git.kernel.org/stable/c/f321cc430c49b6c1be0d53f2ef19d8342d8029cc'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.517Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Input: ati_remote2 - fix type confusion in device attribute handlers

Previously, the channel_mask and mode_mask attributes were registered on
the parent usb_device via sysfs_create_group(). When commit b20d6bf8014b
("Input: ati-remote2 - use driver core to instantiate device
attributes") converted the driver to let the driver core manage them via
dev_groups in struct usb_driver, the attributes moved to the bound
usb_interface devices, but the show and store callbacks were not updated
accordingly.

As a result, the callbacks still invoked to_usb_device() on a device
pointer belonging to a struct usb_interface, producing an invalid
usb_device pointer.

Use to_usb_interface() directly in the attribute handlers to obtain the
interface and its driver data.

## Affected

- `Linux >= b20d6bf8014b2d6fcf65c150453d95a6276fd1fa < e44ec6b6d3c0b8ea089b589fa0cce49a4da66b89`
- `Linux >= b20d6bf8014b2d6fcf65c150453d95a6276fd1fa < d738e51bf2c21921df351f536147178ae3cbd38b`
- `Linux >= b20d6bf8014b2d6fcf65c150453d95a6276fd1fa < 2caae9d1977beea0a7914b3d86639262801fd116`
- `Linux >= b20d6bf8014b2d6fcf65c150453d95a6276fd1fa < f321cc430c49b6c1be0d53f2ef19d8342d8029cc`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.