CVE-2026-98121

Undergoing Analysis Undergoing Analysis - In Progress

NULL Pointer Dereference in Linux Kernel Watchdog Driver

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313e_wdt_probe() doesn't set the driver data for the platform device. As a result, dev_get_drvdata() in msc313e_wdt_suspend() and msc313e_wdt_resume() will return NULL, leading to a NULL pointer dereference afterward. Set the platform device driver data in msc313e_wdt_probe().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98121

EUVD

EUVD-2026-86952

Affected Vendors & Products

Vendor	Product	Version / Range
msc313e	watchdog	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference flaw in the Linux kernel's msc313e watchdog driver. The issue occurs because the msc313e_wdt_probe function fails to set the driver data for the platform device. When the system tries to suspend or resume, the msc313e_wdt_suspend and msc313e_wdt_resume functions call dev_get_drvdata, which returns NULL due to missing driver data. This leads to a crash when the code attempts to dereference the NULL pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's msc313e watchdog driver and can be detected by checking if the affected driver is loaded and if the system is running a vulnerable kernel version. Inspect the kernel log for NULL pointer dereference errors related to msc313e_wdt_suspend or msc313e_wdt_resume. Commands: dmesg | grep -i 'msc313e' or journalctl -k | grep -i 'msc313e'.

Impact Analysis

If you are using a system with the affected Linux kernel and msc313e watchdog hardware, this vulnerability could cause system crashes during suspend or resume operations. This may lead to data loss, unexpected reboots, or denial of service if the watchdog timer fails to function properly.

Compliance Impact

This vulnerability is a NULL pointer dereference in Linux kernel watchdog PM callbacks, which could cause system instability or crashes. It does not directly relate to data handling, access controls, or privacy mechanisms typically addressed by GDPR or HIPAA. Therefore, it likely has no direct impact on compliance with these standards.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this vulnerability. If an update is not immediately available, consider disabling the msc313e watchdog driver if it is not required. Monitor vendor advisories for patches.

Hi! I’m here to help you understand CVE-2026-98121. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70