All vulnerabilities
CVE-2026-98876

Linux: host1x: bus: Fix missing ops null check in error teardown

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in74bd1f05d9ba2d6672d30ccafe80a38104c1f73fAlso 62851e7b0e55de6fe08da08bc41fd587fbcb0e9b, 29375e071ea201fe97bafe1d2ad9d9f30311abfb and 6 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 74bd1f05d9ba2d6672d30ccafe80a38104c1f73fLinuxCVE List
  • 62851e7b0e55de6fe08da08bc41fd587fbcb0e9bLinuxCVE List
  • 29375e071ea201fe97bafe1d2ad9d9f30311abfbLinuxCVE List
  • 71d25f668bc5c0f36ea843462e12307dea45aaa3LinuxCVE List
  • 5.15.222LinuxCVE List
  • 6.1.189LinuxCVE List
Show all 9 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

host1x: bus: Fix missing ops null check in error teardown

In host1x_device_init(), the error teardown paths do not check client->ops before dereferencing it, unlike the forward init paths which correctly guard with 'client->ops &&'. This can result in a NULL pointer dereference if client->ops is NULL.

Fix by adding the missing client->ops check in both the teardown and teardown_late labels.

Text from CVE List

Affected versions 17

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before d8d5b6e02fc281dea33d6b0b0fadaccea56f2067CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f1fa6c936fa9de80ae446ba5e76e227e991b8e56CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 74bd1f05d9ba2d6672d30ccafe80a38104c1f73fCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 62851e7b0e55de6fe08da08bc41fd587fbcb0e9bCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 29375e071ea201fe97bafe1d2ad9d9f30311abfbCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 71d25f668bc5c0f36ea843462e12307dea45aaa3CVE List
  • Linuxaffected: all versions before 5.15.222CVE List
  • Linuxaffected: all versions before 6.1.189CVE List
  • Linuxaffected: all versions before 6.6.158CVE List
  • Linuxaffected: all versions before 6.12.111CVE List
  • Linuxaffected: all versions before 6.18.53CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 6