AZL-110602: CVE-2026-98876 affecting package kernel 6.6.157.1-1
Published Oct 23, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
host1x: bus: Fix missing ops null check in error teardown
In host1xdeviceinit(), the error teardown paths do not check client->ops before dereferencing it, unlike the forward init paths which correctly guard with 'client->ops &&'. This can result in a NULL pointer dereference if client->ops is NULL.
Fix by adding the missing client->ops check in both the teardown and teardownlate labels.
Affected Software
1 affected component
azure-linux/kernel<=6.6.157.1-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In host1x_device_init(), add a client->ops null check before dereferencing client->ops in both the teardown and teardown_late error paths, matching the client->ops && guards used in the forward init paths.
Event History
Oct 23, 2026
Advisory Published
via OSV·12:18 PM
Data Sourced
via OSV·12:18 PM
DescriptionAffected Software