{"id":"CVE-2026-98876","title":"host1x: bus: Fix missing ops null check in error teardown","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nhost1x: bus: Fix missing ops null check in error teardown\n\nIn host1x_device_init(), the error teardown paths do not check\nclient->ops before dereferencing it, unlike th…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d8d5b6e02fc281dea33d6b0b0fadaccea56f2067","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f1fa6c936fa9de80ae446ba5e76e227e991b8e56","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 74bd1f05d9ba2d6672d30ccafe80a38104c1f73f","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 62851e7b0e55de6fe08da08bc41fd587fbcb0e9b","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 29375e071ea201fe97bafe1d2ad9d9f30311abfb","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 71d25f668bc5c0f36ea843462e12307dea45aaa3","Linux < 5.15.222","Linux < 6.1.189","Linux < 6.6.158","Linux < 6.12.111","Linux < 6.18.53","Linux (all versions)"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T11:37:21.776Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98876","references":[{"url":"https://git.kernel.org/stable/c/d8d5b6e02fc281dea33d6b0b0fadaccea56f2067"},{"url":"https://git.kernel.org/stable/c/f1fa6c936fa9de80ae446ba5e76e227e991b8e56"},{"url":"https://git.kernel.org/stable/c/74bd1f05d9ba2d6672d30ccafe80a38104c1f73f"},{"url":"https://git.kernel.org/stable/c/62851e7b0e55de6fe08da08bc41fd587fbcb0e9b"},{"url":"https://git.kernel.org/stable/c/29375e071ea201fe97bafe1d2ad9d9f30311abfb"},{"url":"https://git.kernel.org/stable/c/71d25f668bc5c0f36ea843462e12307dea45aaa3"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.584Z","slug":"CVE-2026-98876","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhost1x: bus: Fix missing ops null check in error teardown\n\nIn host1x_device_init(), the error teardown paths do not check\nclient->ops before dereferencing it, unlike the forward init paths\nwhich correctly guard with 'client->ops &&'. This can result in a\nNULL pointer dereference if client->ops is NULL.\n\nFix by adding the missing client->ops check in both the teardown\nand teardown_late labels.\n\n## Affected\n\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d8d5b6e02fc281dea33d6b0b0fadaccea56f2067`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f1fa6c936fa9de80ae446ba5e76e227e991b8e56`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 74bd1f05d9ba2d6672d30ccafe80a38104c1f73f`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 62851e7b0e55de6fe08da08bc41fd587fbcb0e9b`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 29375e071ea201fe97bafe1d2ad9d9f30311abfb`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 71d25f668bc5c0f36ea843462e12307dea45aaa3`\n- `Linux < 5.15.222`\n- `Linux < 6.1.189`\n- `Linux < 6.6.158`\n- `Linux < 6.12.111`\n- `Linux < 6.18.53`\n- `Linux (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}