CVE-2026-98876 host1x: bus: Fix missing ops null check in error teardown

Not scored Published 23 Oct 2026 Updated 26 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-98876?

CVE-2026-98876 is a vulnerability in Linux, published on 23 Oct 2026.

Official description

In the Linux kernel, the following vulnerability has been resolved:

host1x: bus: Fix missing ops null check in error teardown

In host1x_device_init(), the error teardown paths do not check client->ops before dereferencing it, unlike the forward init paths which correctly guard with 'client->ops &&'. This can result in a NULL pointer dereference if client->ops is NULL.

Fix by adding the missing client->ops check in both the teardown and teardown_late labels.

Which versions are affected by CVE-2026-98876?

How do I fix CVE-2026-98876?

Upgrade to a fixed version.

Is CVE-2026-98876 being exploited?

There is no known exploitation of CVE-2026-98876 in the wild and no public exploit code.

Sources

Also known as AZL-110602, BELL-CVE-2026-98876, DEBIAN-CVE-2026-98876, GHSA-53g5-98c7-5cwc, UBUNTU-CVE-2026-98876.