---
id: "CVE-2026-98998"
kind: "vulnerability"
aliases: ["CVE-2026-98998"]
title: "Linux kernel: HDMI driver teardown on wrong pointer at device removal"
severity: "unknown"
cvss: null
epss: 0.00198
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["drm", "embedded", "infrastructure", "linux-kernel", "th1520"]
not_affected_if: ["driver-not-loaded", "no-th1520-hardware"]
published_at: "2026-10-23T13:17:22+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98998", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98998", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: HDMI driver teardown on wrong pointer at device removal

The T-Head TH1520 HDMI bridge driver in the Linux kernel read back the wrong pointer type from platform data when the device was removed, so teardown ran on the wrong structure. The sources describe a removal-time memory-handling bug and do not state an attacker-reachable impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98998
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98998

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

drm/bridge: th1520-dw-hdmi: Fix remove() callback

This driver stores struct th1520_hdmi * in platform drvdata, but
th1520_dw_hdmi_remove() was reading it back as struct dw_hdmi *
and passing it to dw_hdmi_remove(), so teardown runs on the wrong
pointer.

Retrieve struct th1520_hdmi * from platform drvdata and pass
hdmi->dw_hdmi to dw_hdmi_remove().

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_