{"id":"CVE-2026-98998","kind":"vulnerability","aliases":["CVE-2026-98998"],"related":[],"title":"Linux kernel: HDMI driver teardown on wrong pointer at device removal","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: th1520-dw-hdmi: Fix remove() callback\n\nThis driver stores struct th1520_hdmi * in platform drvdata, but\nth1520_dw_hdmi_remove() was reading it back as struct dw_hdmi *\nand passing it to dw_hdmi_remove(), so teardown runs on the wrong\npointer.\n\nRetrieve struct th1520_hdmi * from platform drvdata and pass\nhdmi->dw_hdmi to dw_hdmi_remove().","summary":"The T-Head TH1520 HDMI bridge driver in the Linux kernel read back the wrong pointer type from platform data when the device was removed, so teardown ran on the wrong structure. The sources describe a removal-time memory-handling bug and do not state an attacker-reachable impact.","severity":"unknown","cvss":null,"epss":0.00198,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drm","embedded","infrastructure","linux-kernel","th1520"],"not_affected_if":["driver-not-loaded","no-th1520-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:55:59+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T04:55:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: HDMI driver teardown on wrong pointer at device removal","impact":"low","summary":"The T-Head TH1520 HDMI bridge driver in the Linux kernel read back the wrong pointer type from platform data when the device was removed, so teardown ran on the wrong structure. The sources describe a removal-time memory-handling bug and do not state an attacker-reachable impact.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","drm","th1520","embedded"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources do not state the impact beyond incorrect teardown","analyst_note":"Check the upstream kernel commit and NVD entry for whether the wrong-pointer teardown causes a crash, memory corruption, or only a driver-unbind issue.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-th1520-hardware","driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the th1520-dw-hdmi DRM bridge driver, typically TH1520-based boards, where the driver can be unbound or removed. Hosts without that hardware or driver are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00058,"input_tokens":3414,"output_tokens":478,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98998':14A,17A 'attack':75B 'attacker-reach':74B 'back':38B,113C 'bridg':31B 'bug':68B 'callback':95C 'cve':12A,15A 'data':45B 'describ':60B 'devic':10A,48B 'driver':4A,32B,97C 'drm':18B 'drm/bridge':88C 'drvdata':104C,138C 'dw':91C,107C,116C,122C,142C,145C 'embed':19B 'fix':93C 'follow':83C 'handl':67B 'hdmi':3A,30B,92C,101C,108C,117C,123C,135C,141C,143C,146C 'head':28B 'impact':77B 'infrastructur':20B 'kernel':2A,23B,36B,81C 'linux':1A,22B,35B,80C 'linux-kernel':21B 'memori':66B 'memory-handl':65B 'pass':119C,140C 'platform':44B,103C,137C 'pointer':8A,41B,131C 'ran':53B 'reachabl':76B 'read':37B,111C 'remov':11A,50B,63B,94C,109C,124C,147C 'removal-tim':62B 'resolv':87C 'retriev':132C 'run':127C 'sourc':59B 'state':72B 'store':98C 'struct':99C,115C,133C 'structur':57B 't-head':26B 'teardown':5A,52B,126C 'th1520':24B,29B,90C,100C,106C,134C 'th1520-dw-hdmi':89C 'time':64B 'type':42B 'vulner':84C 'wrong':7A,40B,56B,130C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the th1520-dw-hdmi DRM bridge driver, typically TH1520-based boards, where the driver can be unbound or removed. Hosts without that hardware or driver are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98998","severity":null,"published_at":"2026-10-23T13:17:22+00:00","modified_at":"2026-10-23T13:17:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98998","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98998","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}