CVE-2026-98876 - Vulnerability Details

- host1x: bus: Fix missing ops null check in error teardown

Description

In the Linux kernel, the following vulnerability has been resolved:

host1x: bus: Fix missing ops null check in error teardown

In host1x_device_init(), the error teardown paths do not check
client->ops before dereferencing it, unlike the forward init paths
which correctly guard with 'client->ops &&'. This can result in a
NULL pointer dereference if client->ops is NULL.

Fix by adding the missing client->ops check in both the teardown
and teardown_late labels.

Published: 2026-10-23

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8f7da1578e90bf1af30269dc6dd8806c96e9c683`	affected	< d8d5b6e02fc281dea33d6b0b0fadaccea56f2067
`8f7da1578e90bf1af30269dc6dd8806c96e9c683`	affected	< f1fa6c936fa9de80ae446ba5e76e227e991b8e56
`8f7da1578e90bf1af30269dc6dd8806c96e9c683`	affected	< 74bd1f05d9ba2d6672d30ccafe80a38104c1f73f
`8f7da1578e90bf1af30269dc6dd8806c96e9c683`	affected	< 62851e7b0e55de6fe08da08bc41fd587fbcb0e9b
`8f7da1578e90bf1af30269dc6dd8806c96e9c683`	affected	< 29375e071ea201fe97bafe1d2ad9d9f30311abfb
`8f7da1578e90bf1af30269dc6dd8806c96e9c683`	affected	< 71d25f668bc5c0f36ea843462e12307dea45aaa3

Linux

affected

Version	Status	Constraints
`4.16`	affected	—
`0`	unaffected	< 4.16
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d8d5b6e02fc281dea33d6b0b0fadaccea56f2067)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f1fa6c936fa9de80ae446ba5e76e227e991b8e56)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,74bd1f05d9ba2d6672d30ccafe80a38104c1f73f)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,62851e7b0e55de6fe08da08bc41fd587fbcb0e9b)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,29375e071ea201fe97bafe1d2ad9d9f30311abfb)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,71d25f668bc5c0f36ea843462e12307dea45aaa3)`	affected	generic	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`[5.15.222,5.15.*]`	unaffected	generic	—
`[6.1.189,6.1.*]`	unaffected	generic	—
`[6.6.158,6.6.*]`	unaffected	generic	—
`[6.12.111,6.12.*]`	unaffected	generic	—
`[6.18.53,6.18.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d8d5b6e02fc281dea33d6b0b0fadaccea56f2067)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f1fa6c936fa9de80ae446ba5e76e227e991b8e56)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,74bd1f05d9ba2d6672d30ccafe80a38104c1f73f)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,62851e7b0e55de6fe08da08bc41fd587fbcb0e9b)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,29375e071ea201fe97bafe1d2ad9d9f30311abfb)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,71d25f668bc5c0f36ea843462e12307dea45aaa3)`	affected	generic	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[5.15.222,5.15.*]`	unaffected	generic	—
`[6.1.189,6.1.*]`	unaffected	generic	—
`[6.6.158,6.6.*]`	unaffected	generic	—
`[6.12.111,6.12.*]`	unaffected	generic	—
`[6.18.53,6.18.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00179.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98876.mbox
https://git.kernel.org/stable/c/29375e071ea201fe97bafe1d2ad9d9f30311abfb
https://git.kernel.org/stable/c/62851e7b0e55de6fe08da08bc41fd587fbcb0e9b
https://git.kernel.org/stable/c/71d25f668bc5c0f36ea843462e12307dea45aaa3
https://git.kernel.org/stable/c/74bd1f05d9ba2d6672d30ccafe80a38104c1f73f
https://git.kernel.org/stable/c/d8d5b6e02fc281dea33d6b0b0fadaccea56f2067
https://git.kernel.org/stable/c/f1fa6c936fa9de80ae446ba5e76e227e991b8e56
https://nvd.nist.gov/vuln/detail/CVE-2026-98876
https://www.cve.org/CVERecord?id=CVE-2026-98876

History

Mon, 26 Oct 2026 13:15:00 +0100

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98876.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98876 https://www.cve.org/CVERecord?id=CVE-2026-98876
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 16:45:00 +0200

Type	Values Removed	Values Added
First Time appeared		Linux linux
Weaknesses		CWE-476
Vendors & Products		Linux linux

Fri, 23 Oct 2026 14:00:00 +0200

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1x_device_init(), the error teardown paths do not check client->ops before dereferencing it, unlike the forward init paths which correctly guard with 'client->ops &&'. This can result in a NULL pointer dereference if client->ops is NULL. Fix by adding the missing client->ops check in both the teardown and teardown_late labels.
Title		host1x: bus: Fix missing ops null check in error teardown
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/29375e071ea201fe97bafe1d2ad9d9f30311abfb https://git.kernel.org/stable/c/62851e7b0e55de6fe08da08bc41fd587fbcb0e9b https://git.kernel.org/stable/c/71d25f668bc5c0f36ea843462e12307dea45aaa3 https://git.kernel.org/stable/c/74bd1f05d9ba2d6672d30ccafe80a38104c1f73f https://git.kernel.org/stable/c/d8d5b6e02fc281dea33d6b0b0fadaccea56f2067 https://git.kernel.org/stable/c/f1fa6c936fa9de80ae446ba5e76e227e991b8e56

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T11:37:21.776Z

Updated: 2026-10-26T06:55:58.587Z

Reserved: 2026-09-25T10:25:14.377Z

Link: CVE-2026-98876

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T12:18:21.090

Modified: 2026-10-26T07:17:12.047

Link: CVE-2026-98876

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-98876 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-26T15:30:13Z

Weaknesses

CWE-476
NULL Pointer Dereference

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object