{"id":"CVE-2026-98876","kind":"vulnerability","aliases":["CVE-2026-98876"],"related":[],"title":"Linux kernel: host1x error teardown can dereference a null pointer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nhost1x: bus: Fix missing ops null check in error teardown\n\nIn host1x_device_init(), the error teardown paths do not check\nclient->ops before dereferencing it, unlike the forward init paths\nwhich correctly guard with 'client->ops &&'. This can result in a\nNULL pointer dereference if client->ops is NULL.\n\nFix by adding the missing client->ops check in both the teardown\nand teardown_late labels.","summary":"In the Linux kernel's host1x bus code, the error teardown paths dereference client->ops without checking it for NULL, unlike the forward init paths. A NULL client->ops during a failed device init can crash the kernel.","severity":"unknown","cvss":null,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","nvidia-tegra"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T12:18:21+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:13+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:00:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: host1x error teardown can dereference a null pointer","impact":"low","summary":"In the Linux kernel's host1x bus code, the error teardown paths dereference client->ops without checking it for NULL, unlike the forward init paths. A NULL client->ops during a failed device init can crash the kernel.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","nvidia-tegra"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel null pointer dereference causes a crash during device init failure","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000487,"input_tokens":3374,"output_tokens":300,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98876':13A,16A 'add':124C 'bus':30B,73C 'check':40B,78C,92C,129C 'client':37B,51B,93C,107C,118C,127C 'code':31B 'correct':104C 'crash':59B 'cve':11A,14A 'derefer':7A,36B,116C 'dereferenc':96C 'devic':56B,84C 'error':4A,33B,80C,87C 'fail':55B 'fix':74C,122C 'follow':67C 'forward':46B,100C 'guard':105C 'host1x':3A,29B,72C,83C 'infrastructur':17B 'init':47B,57B,85C,101C 'kernel':2A,20B,27B,61B,65C 'label':137C 'late':136C 'linux':1A,19B,26B,64C 'linux-kernel':18B 'miss':75C,126C 'null':9A,43B,50B,77C,114C,121C 'nvidia':22B 'nvidia-tegra':21B 'op':38B,52B,76C,94C,108C,119C,128C 'path':35B,48B,89C,102C 'pointer':10A,115C 'resolv':71C 'result':111C 'teardown':5A,34B,81C,88C,133C,135C 'tegra':23B 'unlik':44B,98C 'vulner':68C 'without':39B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98876","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98876","severity":null,"published_at":"2026-10-23T12:18:21+00:00","modified_at":"2026-10-23T12:18:21+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98876","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98876","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}