Cloudanix VulnDB

CVE-2026-98998

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small coding mistake in a Linux display driver can cause crashes when the driver is removed, and updating the kernel fixes it.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Type confusion in the th1520-dw-hdmi driver remove callback causes the wrong pointer type to be passed to dw_hdmi_remove, resulting in teardown operations on an incorrect memory object and potential memory corruption or invalid accesses during driver unload.

Why it matters to the business

Driver removal on affected systems can trigger kernel instability, crashes, or resource leaks, disrupting display functionality and requiring reboots; low exploitability keeps immediate operational risk modest but unpatched kernels remain exposed in future updates.

How an attack unfolds

An attacker with local access triggers module unload or device removal (via hotplug or rmmod) on a system using the th1520 HDMI bridge; the mismatched pointer dereference during cleanup leads to invalid memory operations that may be leveraged for corruption or crashes.

How to fix it

Update to a kernel containing the corrected th1520_dw_hdmi_remove implementation that retrieves struct th1520_hdmi * and passes the proper hdmi->dw_hdmi member; rebuild and deploy the fixed kernel image across affected hardware.

How to confirm the fix worked

Inspect kernel source for the updated remove callback that casts drvdata to struct th1520_hdmi *; verify driver load/unload cycles complete without kernel warnings or oops on th1520 hardware; run targeted module removal tests.

Typical attack path

  1. Obtain local access to target Linux system with the vulnerable driver loaded
  2. Trigger platform device removal or module unload sequence
  3. Driver remove callback reads incorrect pointer type from drvdata
  4. dw_hdmi_remove receives invalid pointer and performs erroneous teardown
  5. Resulting invalid memory access enables corruption or denial of service

How to detect it

Review kernel logs for oops or warning messages referencing th1520_hdmi or dw_hdmi during module removal; examine dmesg and journalctl output around device hotplug or driver unload events for pointer-related faults.

What your security team should do

  • Prioritize kernel upgrade on any systems exposing the th1520 HDMI bridge driver
  • Monitor for future backports into distribution kernels given the recent publication
  • Include driver unload paths in regression testing for display hardware

The record

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove() callback This driver stores struct th1520_hdmi * in platform drvdata, but th1520_dw_hdmi_remove() was reading it back as struct dw_hdmi * and passing it to dw_hdmi_remove(), so teardown runs on the wrong pointer. Retrieve struct th1520_hdmi * from platform drvdata and pass hdmi->dw_hdmi to dw_hdmi_remove().

Affected packages

Ecosystem Package Introduced Fixed