CVE-2026-45978 staging: greybus: lights: avoid NULL deref
A NULL pointer dereference in the Linux kernel greybus lights driver can cause a denial of service if memory allocation fails.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45978?
CVE-2026-45978 is a medium-severity vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
staging: greybus: lights: avoid NULL deref
gb_lights_light_config() stores channel_count before allocating the channels array. If kcalloc() fails, gb_lights_release() iterates the non-zero count and dereferences light->channels, which is NULL.
Allocate channels first and only then publish channels_count so the cleanup path can't walk a NULL pointer.
Weakness: CWE-476
Which versions are affected by CVE-2026-45978?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-45978?
Apply the vendor's patch.
Is CVE-2026-45978 being exploited?
There is no known exploitation of CVE-2026-45978 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-45978, DEBIAN-CVE-2026-45978, GHSA-wq92-r227-xxxp, ROOT-OS-DEBIAN-11-CVE-2026-45978, ROOT-OS-UBUNTU-2204-CVE-2026-45978, ROOT-OS-UBUNTU-2404-CVE-2026-45978 and 1 more.