CVE-2026-98412

What it actually does

In the power sequencing subsystem, an allocation failure in pwrseq_unit_setup_deps causes pwrseq_unit_put to invoke pwrseq_unit_release on a struct whose list head was never initialized, so list_del unconditionally dereferences an uninitialized pointer.

Why it matters to the business

A low-probability kernel crash during device power initialization can produce sudden reboots or boot failures on affected systems, increasing operational downtime in environments that rely on the power sequencing framework.

How an attack unfolds

An attacker would need to induce a precise memory-allocation failure inside pwrseq_unit_setup_deps while the unit is only partially constructed; because the trigger requires control over kernel memory pressure and no public exploit exists, the path is considered non-exploitable in practice.

How to fix it

Apply the upstream fix that initializes unit->list immediately after allocation; rebuild and deploy the patched kernel. No downstream fixed-version packages are listed for this change.

How to confirm the fix worked

Confirm the presence of the initialization statement for unit->list right after the allocation site in pwrseq_unit_new; run kernel build tests that exercise pwrseq error paths under memory-pressure simulation.

Typical attack path

1. Trigger high memory pressure to force kmalloc failure inside pwrseq_unit_setup_deps
2. Allow the error path to call pwrseq_unit_put on the partially-initialized unit
3. pwrseq_unit_release performs list_del on the uninitialized list head
4. Kernel dereferences invalid memory and panics

How to detect it

Review kernel logs for oops or panic messages referencing pwrseq_unit_release or list_del near power sequencing initialization; no public indicators of active exploitation are known.

What your security team should do

• Prioritize kernel update on systems that use the power-sequencing framework within the next maintenance window
• Monitor upstream stable branches for back-ports of the listed commit
• Include power-sequencing error paths in future kernel fuzzing campaigns