Cloudanix VulnDB

CVE-2026-98411

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's power management code could cause systems to crash under certain error conditions during device setup.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A NULL pointer dereference occurs in pwrseq_release() when pwrseq_device_register() fails at dev_set_name() before initializing the targets list head, leading to invalid memory access during cleanup.

Why it matters to the business

May cause kernel crashes or instability on Linux systems during device power sequencing operations, potentially affecting system availability.

How an attack unfolds

An attacker triggers an error condition in device name setting during power sequence device registration, causing the release function to dereference an uninitialized pointer.

How to fix it

Apply the kernel patch that moves dev_set_name call after list head initialization. Upgrade to a patched Linux kernel version.

How to confirm the fix worked

Review kernel source for the corrected initialization order in pwrseq_device_register and test error paths in power sequencing registration.

Typical attack path

  1. Trigger failure in dev_set_name during pwrseq_device_register
  2. Cause jump to error label without targets initialization
  3. Invoke pwrseq_release to dereference invalid pointer

How to detect it

Look for kernel oops or panic logs related to pwrseq_release or NULL pointer dereferences in power sequencing code.

What your security team should do

  • Monitor for kernel updates addressing this issue
  • Test power management functionality after updates
  • Review affected device drivers using pwrseq

The record

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() If dev_set_name() fails in pwrseq_device_register(), we jump to the err_put_pwrseq label before initializing pwrseq->targets. pwrseq_release() will try to iterate over targets unconditionally and subsequently dereference an invalid pointer. Move the call to dev_set_name() after the list head is initialized.

Affected packages

Ecosystem Package Introduced Fixed