---
id: CVE-2026-98876
title: 'host1x: bus: Fix missing ops null check in error teardown'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  host1x: bus: Fix missing ops null check in error teardown

  In host1x_device_init(), the error teardown paths do not check
  client->ops before dereferencing it, unlike th…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    d8d5b6e02fc281dea33d6b0b0fadaccea56f2067
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    f1fa6c936fa9de80ae446ba5e76e227e991b8e56
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    74bd1f05d9ba2d6672d30ccafe80a38104c1f73f
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    62851e7b0e55de6fe08da08bc41fd587fbcb0e9b
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    29375e071ea201fe97bafe1d2ad9d9f30311abfb
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    71d25f668bc5c0f36ea843462e12307dea45aaa3
  - Linux < 5.15.222
  - Linux < 6.1.189
  - Linux < 6.6.158
  - Linux < 6.12.111
  - Linux < 6.18.53
  - Linux (all versions)
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T11:37:21.776Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98876'
references:
  - url: 'https://git.kernel.org/stable/c/d8d5b6e02fc281dea33d6b0b0fadaccea56f2067'
  - url: 'https://git.kernel.org/stable/c/f1fa6c936fa9de80ae446ba5e76e227e991b8e56'
  - url: 'https://git.kernel.org/stable/c/74bd1f05d9ba2d6672d30ccafe80a38104c1f73f'
  - url: 'https://git.kernel.org/stable/c/62851e7b0e55de6fe08da08bc41fd587fbcb0e9b'
  - url: 'https://git.kernel.org/stable/c/29375e071ea201fe97bafe1d2ad9d9f30311abfb'
  - url: 'https://git.kernel.org/stable/c/71d25f668bc5c0f36ea843462e12307dea45aaa3'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.584Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

host1x: bus: Fix missing ops null check in error teardown

In host1x_device_init(), the error teardown paths do not check
client->ops before dereferencing it, unlike the forward init paths
which correctly guard with 'client->ops &&'. This can result in a
NULL pointer dereference if client->ops is NULL.

Fix by adding the missing client->ops check in both the teardown
and teardown_late labels.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d8d5b6e02fc281dea33d6b0b0fadaccea56f2067`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f1fa6c936fa9de80ae446ba5e76e227e991b8e56`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 74bd1f05d9ba2d6672d30ccafe80a38104c1f73f`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 62851e7b0e55de6fe08da08bc41fd587fbcb0e9b`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 29375e071ea201fe97bafe1d2ad9d9f30311abfb`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 71d25f668bc5c0f36ea843462e12307dea45aaa3`
- `Linux < 5.15.222`
- `Linux < 6.1.189`
- `Linux < 6.6.158`
- `Linux < 6.12.111`
- `Linux < 6.18.53`
- `Linux (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.