---
id: CVE-2026-98665
title: 'iio: health: max30102: fix NULL dereference in interrupt handler'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iio: health: max30102: fix NULL dereference in interrupt handler

  The interrupt is requested in max30102_probe() and stays enabled
  for the lifetime of the device, but i…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 90579b69e94bf11ea0745ff003e82a6ce9725f96 <
    eeb23ba97bd8016e815ef70300b8d34a0a316b90
  - >-
    Linux >= 90579b69e94bf11ea0745ff003e82a6ce9725f96 <
    60699102827fdb51f9591414165359c8e867f302
  - >-
    Linux >= 90579b69e94bf11ea0745ff003e82a6ce9725f96 <
    8d6f98972fe2bd6f73f39d982af0c85d766a1503
  - >-
    Linux >= 90579b69e94bf11ea0745ff003e82a6ce9725f96 <
    f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d
  - Linux 4.16
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:44:35.323Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98665'
references:
  - url: 'https://git.kernel.org/stable/c/eeb23ba97bd8016e815ef70300b8d34a0a316b90'
  - url: 'https://git.kernel.org/stable/c/60699102827fdb51f9591414165359c8e867f302'
  - url: 'https://git.kernel.org/stable/c/8d6f98972fe2bd6f73f39d982af0c85d766a1503'
  - url: 'https://git.kernel.org/stable/c/f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.534Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iio: health: max30102: fix NULL dereference in interrupt handler

The interrupt is requested in max30102_probe() and stays enabled
for the lifetime of the device, but indio_dev->active_scan_mask is only
valid while a buffer is enabled. When an interrupt arrives while no
buffer is enabled, the handler dereferences the NULL active_scan_mask:

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
  Call trace:
   __bitmap_weight+0x64/0x98 (P)
   max30102_interrupt_handler+0x48/0x160 [max30102]

Call max30102_fifo_count() at the top of the handler and return early
unless it reports a FIFO sample is ready. Because FIFO_RDY is the only
interrupt source enabled in max30102_chip_init(), an invocation of
max30102_interrupt_handler() without the FIFO_RDY interrupt status bit
set carries no data to read and can return before touching
active_scan_mask. A negative return from max30102_fifo_count()
indicates a failed interrupt status read and is treated the same way.

## Affected

- `Linux >= 90579b69e94bf11ea0745ff003e82a6ce9725f96 < eeb23ba97bd8016e815ef70300b8d34a0a316b90`
- `Linux >= 90579b69e94bf11ea0745ff003e82a6ce9725f96 < 60699102827fdb51f9591414165359c8e867f302`
- `Linux >= 90579b69e94bf11ea0745ff003e82a6ce9725f96 < 8d6f98972fe2bd6f73f39d982af0c85d766a1503`
- `Linux >= 90579b69e94bf11ea0745ff003e82a6ce9725f96 < f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d`
- `Linux 4.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.