All vulnerabilities
CVE-2026-98665

Linux: iio: health: max30102: fix NULL dereference in interrupt handler

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2a74f30a7bb305cdc5c3e3e9239b32bb84f3529fAlso 60699102827fdb51f9591414165359c8e867f302, 8d6f98972fe2bd6f73f39d982af0c85d766a1503CVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 2a74f30a7bb305cdc5c3e3e9239b32bb84f3529fLinuxCVE List
  • 60699102827fdb51f9591414165359c8e867f302LinuxCVE List
  • 8d6f98972fe2bd6f73f39d982af0c85d766a1503LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: health: max30102: fix NULL dereference in interrupt handler

The interrupt is requested in max30102_probe() and stays enabled for the lifetime of the device, but indio_dev->active_scan_mask is only valid while a buffer is enabled. When an interrupt arrives while no buffer is enabled, the handler dereferences the NULL active_scan_mask:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: __bitmap_weight+0x64/0x98 (P) max30102_interrupt_handler+0x48/0x160 [max30102]

Call max30102_fifo_count() at the top of the handler and return early unless it reports a FIFO sample is ready. Because FIFO_RDY is the only interrupt source enabled in max30102_chip_init(), an invocation of max30102_interrupt_handler() without the FIFO_RDY interrupt status bit set carries no data to read and can return before touching active_scan_mask. A negative return from max30102_fifo_count() indicates a failed interrupt status read and is treated the same way.

Text from CVE List

Affected versions 12

  • Linuxaffected: 90579b69e94bf11ea0745ff003e82a6ce9725f96 before 2a74f30a7bb305cdc5c3e3e9239b32bb84f3529fCVE List
  • Linuxaffected: 90579b69e94bf11ea0745ff003e82a6ce9725f96 before eeb23ba97bd8016e815ef70300b8d34a0a316b90CVE List
  • Linuxaffected: 90579b69e94bf11ea0745ff003e82a6ce9725f96 before 60699102827fdb51f9591414165359c8e867f302CVE List
  • Linuxaffected: 90579b69e94bf11ea0745ff003e82a6ce9725f96 before 8d6f98972fe2bd6f73f39d982af0c85d766a1503CVE List
  • Linuxaffected: 90579b69e94bf11ea0745ff003e82a6ce9725f96 before f0ea4824deebf21dacfbe397c4b0a5fd3e745a8dCVE List
  • Linuxaffected: 4.16CVE List
  • Linuxunaffected: all versions before 4.16CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5