NULL pointer dereference in Linux kernel - CVE-2026-98412

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null-pointer dereference caused by an uninitialized unit list in the power-sequencing subsystem when releasing a partially initialized unit after a memory allocation failure. A local user can trigger this cleanup path to cause a denial of service.

Affected software

How to mitigate CVE-2026-98412

External References

• https://git.kernel.org/stable/c/115b303e8e093d964089ec6f3c40d984d77b33d0
• https://git.kernel.org/stable/c/29e03670cc384561a2037c69b0a1cc5232d3c6c3
• https://git.kernel.org/stable/c/6e571aea60de7f4c62b77510495d1bcc7df406a1
• https://git.kernel.org/stable/c/859880b07a75c7a29d141abfacbd750d25a8e920

Related Security Bulletins

• NULL pointer dereference in Linux kernel power sequencing driver
• Debian update for linux