Cloudanix VulnDB

CVE-2026-98876

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A recent Linux kernel bug can cause crashes during certain hardware setup errors on systems that handle graphics and multimedia devices.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing null check on client->ops before dereference in host1x_device_init() error teardown paths allows NULL pointer dereference during device initialization failure handling.

Why it matters to the business

Kernel crashes or instability on systems using the host1x subsystem, potentially disrupting graphics, multimedia, or embedded device operations with high downstream Linux kernel prevalence.

How an attack unfolds

An attacker triggers an error condition during host1x client device initialization such that client->ops remains NULL, causing the teardown path to dereference the null pointer and crash the kernel.

How to fix it

Apply the upstream fix that adds client->ops null checks in both teardown and teardown_late labels; update to a patched Linux kernel version containing this resolution.

How to confirm the fix worked

Review host1x bus initialization code for presence of 'client->ops &&' guards on teardown paths; confirm kernel version includes the resolved commit.

Typical attack path

  1. Identify or create conditions that cause host1x_device_init() to enter error paths
  2. Ensure client->ops is NULL at the point of teardown or teardown_late labels
  3. Trigger the vulnerable error handling code path
  4. Induce NULL pointer dereference to crash the kernel

How to detect it

Examine kernel logs and crash dumps for NULL pointer dereference faults originating from host1x_device_init error paths; no widespread exploitation observed given stable low EPSS and absence from KEV.

What your security team should do

  • Prioritize kernel updates on all affected Linux systems within standard patch windows given low EPSS and no KEV listing
  • Monitor upstream host1x and tegra driver changes for additional related fixes
  • Limit exposure by restricting untrusted module loading or device initialization where host1x is active

The record

In the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1x_device_init(), the error teardown paths do not check client->ops before dereferencing it, unlike the forward init paths which correctly guard with 'client->ops &&'. This can result in a NULL pointer dereference if client->ops is NULL. Fix by adding the missing client->ops check in both the teardown and teardown_late labels.

Affected packages

Ecosystem Package Introduced Fixed