CVE-2026-98412

Received Received - Intake

NULL-pointer Dereference in Linux Kernel Power Sequencing Subsystem

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() If memory allocation fails in pwrseq_unit_setup_deps(), pwrseq_unit_put() is called to release the partially initialized unit. However, we've never initialized unit->list and pwrseq_unit_release() will unconditionally call list_del() on it. Initialize unit->list right after allocating the unit struct.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98412

EUVD

EUVD-2026-101061

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	249ebf3f65f8530beb2cbfb91bff1d83ba88d23c
Linux	Linux	249ebf3f65f8530beb2cbfb91bff1d83ba88d23c
Linux	Linux	249ebf3f65f8530beb2cbfb91bff1d83ba88d23c
Linux	Linux	249ebf3f65f8530beb2cbfb91bff1d83ba88d23c
Linux	Linux	6.11

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL-pointer dereference vulnerability in the Linux kernel's power sequencing subsystem. It occurs when memory allocation fails during initialization, leading to a partially initialized structure. The pwrseq_unit_put() function attempts to release this structure, but pwrseq_unit_release() tries to delete an uninitialized list pointer, causing a crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's power sequencing subsystem and may not have direct network detection methods. Check kernel logs for NULL-pointer dereference errors related to pwrseq_unit_new() or pwrseq_unit_put(). Use commands like dmesg | grep -i 'pwrseq' or journalctl -k | grep -i 'pwrseq' to inspect system logs for related errors.

Impact Analysis

This vulnerability can cause system crashes or kernel panics if the affected power sequencing code is triggered. It may lead to denial-of-service conditions, requiring a system reboot to recover. Systems relying on power management features could experience instability.

Compliance Impact

This vulnerability is a NULL-pointer dereference in the Linux kernel's power sequencing subsystem. It does not directly relate to data protection, privacy, or security controls typically addressed by GDPR or HIPAA. The issue is localized to kernel memory management and does not involve unauthorized data access or processing.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel updates from your distribution vendor and apply patches promptly. If immediate patching is not possible, consider disabling affected power sequencing modules if they are not critical to your system.

Hi! I’m here to help you understand CVE-2026-98412. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70