Linux Kernel Vulnerability in Host1X Device Initialization

CVE-2026-98876

What is CVE-2026-98876?

A vulnerability in the Linux kernel's host1x device initialization can lead to a NULL pointer dereference. Specifically, in the host1x_device_init function, error teardown paths fail to verify the client->ops before dereferencing it, unlike the forward initialization paths that include a proper guard. This oversight could cause system instability if client->ops is NULL. The issue has been fixed by adding the necessary NULL check in both the teardown and teardown_late procedures, enhancing the robustness of the initialization process.

References