{"id":"CVE-2026-98665","kind":"vulnerability","aliases":["CVE-2026-98665"],"related":[],"title":"Linux kernel: MAX30102 sensor interrupt can crash the system with NULL dereference","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: health: max30102: fix NULL dereference in interrupt handler\n\nThe interrupt is requested in max30102_probe() and stays enabled\nfor the lifetime of the device, but indio_dev->active_scan_mask is only\nvalid while a buffer is enabled. When an interrupt arrives while no\nbuffer is enabled, the handler dereferences the NULL active_scan_mask:\n\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n  Call trace:\n   __bitmap_weight+0x64/0x98 (P)\n   max30102_interrupt_handler+0x48/0x160 [max30102]\n\nCall max30102_fifo_count() at the top of the handler and return early\nunless it reports a FIFO sample is ready. Because FIFO_RDY is the only\ninterrupt source enabled in max30102_chip_init(), an invocation of\nmax30102_interrupt_handler() without the FIFO_RDY interrupt status bit\nset carries no data to read and can return before touching\nactive_scan_mask. A negative return from max30102_fifo_count()\nindicates a failed interrupt status read and is treated the same way.","summary":"A kernel driver for the MAX30102 heart-rate sensor dereferenced a NULL pointer in its interrupt handler when no data buffer was active. The result is a kernel crash (denial of service) triggered by the sensor's interrupt line.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","iio-sensors","linux-kernel","other"],"not_affected_if":["module-not-loaded","no-max30102-hardware"],"how_to_check":"- Check whether the `max30102` kernel module is loaded with `lsmod | grep max30102`\n- Confirm the kernel version against the fixed release listed in the upstream commit: unknown","fix":"- Update the Linux kernel to a release that includes the upstream fix in iio: health: max30102 (version unknown)\n- Until patched, unload the driver with `modprobe -r max30102` if the sensor is not needed","status":"open","published_at":"2026-10-18T16:17:19+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:27+00:00","updated_at":"2026-10-25T05:19:27+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T05:19:27Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix in iio: health: max30102 (version unknown)\n- Until patched, unload the driver with `modprobe -r max30102` if the sensor is not needed","reach":"local","title":"Linux kernel: MAX30102 sensor interrupt can crash the system with NULL dereference","impact":"low","summary":"A kernel driver for the MAX30102 heart-rate sensor dereferenced a NULL pointer in its interrupt handler when no data buffer was active. The result is a kernel crash (denial of service) triggered by the sensor's interrupt line.","category":"other","nicknames":[],"who_cares":["linux-kernel","embedded","iio-sensors"],"confidence":0.6,"needs_auth":"no","worst_case":"kernel crashes when the sensor raises an interrupt","analyst_note":"","how_to_check":"- Check whether the `max30102` kernel module is loaded with `lsmod | grep max30102`\n- Confirm the kernel version against the fixed release listed in the upstream commit: unknown","needs_analyst":false,"not_affected_if":["no-max30102-hardware","module-not-loaded"],"who_is_affected":"Only systems with a MAX30102 sensor bound to this IIO driver are exposed, which is typically embedded or specialized hardware rather than servers. Machines without that hardware or without the max30102 module loaded can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000626,"input_tokens":3617,"output_tokens":529,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':147C,153C '-2026':14A,17A '-98665':15A,18A '0000000000000000':142C 'activ':49B,104C,129C,214C 'address':141C 'arriv':118C 'bit':202C 'bitmap':145C 'buffer':47B,112C,121C 'call':143C,156C 'carri':204C 'chip':188C 'count':159C,223C 'crash':7A,55B 'cve':13A,16A 'data':46B,206C 'denial':56B 'derefer':12A,81C,126C,138C 'dereferenc':36B 'dev':103C 'devic':100C 'driver':28B 'earli':168C 'embed':19B 'enabl':94C,114C,123C,185C 'fail':226C 'fifo':158C,173C,178C,198C,222C 'fix':79C 'follow':71C 'handl':134C 'handler':43B,84C,125C,152C,165C,195C 'health':77C 'heart':33B 'heart-rat':32B 'iio':21B,76C 'iio-sensor':20B 'indic':224C 'indio':102C 'init':189C 'interrupt':5A,42B,64B,83C,86C,117C,151C,183C,194C,200C,227C 'invoc':191C 'kernel':2A,25B,27B,54B,69C,135C 'lifetim':97C 'line':65B 'linux':1A,24B,68C 'linux-kernel':23B 'mask':106C,131C,216C 'max30102':3A,31B,78C,90C,150C,155C,157C,187C,193C,221C 'negat':218C 'null':11A,38B,80C,128C,136C 'p':149C 'pointer':39B,137C 'probe':91C 'rate':34B 'rdi':179C,199C 'read':208C,229C 'readi':176C 'report':171C 'request':88C 'resolv':75C 'result':51B 'return':167C,211C,219C 'sampl':174C 'scan':105C,130C,215C 'sensor':4A,22B,35B,62B 'servic':58B 'set':203C 'sourc':184C 'status':201C,228C 'stay':93C 'system':9A 'top':162C 'touch':213C 'trace':144C 'treat':232C 'trigger':59B 'unabl':132C 'unless':169C 'valid':109C 'virtual':140C 'vulner':72C 'way':235C 'weight':146C 'without':196C 'x48/0x160':154C 'x64/0x98':148C","nicknames":[],"mitigations":[],"who_affected":"Only systems with a MAX30102 sensor bound to this IIO driver are exposed, which is typically embedded or specialized hardware rather than servers. Machines without that hardware or without the max30102 module loaded can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98665","severity":null,"published_at":"2026-10-18T16:17:19+00:00","modified_at":"2026-10-21T13:21:35+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}