CVE-2026-98876None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1x_device_init(), the error teardown paths do not check client->ops before dereferencing it, unlike th…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In the Linux kernel, the following vulnerability has been resolved:
host1x: bus: Fix missing ops null check in error teardown
In host1x_device_init(), the error teardown paths do not check client->ops before dereferencing it, unlike the forward init paths which correctly guard with 'client->ops &&'. This can result in a NULL pointer dereference if client->ops is NULL.
Fix by adding the missing client->ops check in both the teardown and teardown_late labels.
Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d8d5b6e02fc281dea33d6b0b0fadaccea56f2067Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f1fa6c936fa9de80ae446ba5e76e227e991b8e56Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 74bd1f05d9ba2d6672d30ccafe80a38104c1f73fLinux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 62851e7b0e55de6fe08da08bc41fd587fbcb0e9bLinux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 29375e071ea201fe97bafe1d2ad9d9f30311abfbLinux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 71d25f668bc5c0f36ea843462e12307dea45aaa3Linux < 5.15.222Linux < 6.1.189Linux < 6.6.158Linux < 6.12.111Linux < 6.18.53Linux (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99001Nonedrm/xe/i2c: cancel the client work on remove
CVE-2026-98989Nonenamespace: check a recursive bind mount for mount namespace loops
CVE-2026-98988Nonenamespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-98992Nonenamespace: don't copy an unmounted mount tree
CVE-2026-98991Nonenamespace: queue a mount only once for mount notifications
CVE-2026-98990Nonenamespace: check a submount for references right before unmounting it