CVE-2026-98412: power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()
In the Linux kernel, the following vulnerability has been resolved:
power: sequencing: fix NULL-pointer dereference in pwrsequnitnew()
If memory allocation fails in pwrsequnitsetupdeps(), pwrsequnitput() is called to release the partially initialized unit. However, we've never initialized unit->list and pwrsequnitrelease() will unconditionally call listdel() on it. Initialize unit->list right after allocating the unit struct.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Under what condition can this issue be triggered?
The NULL-pointer dereference can occur when memory allocation fails during pwrseq_unit_setup_deps() while creating a power-sequencing unit. Cleanup of the partially initialized unit then calls list_del() on an uninitialized unit->list.
What is the practical impact of the failure?
The described outcome is a NULL-pointer dereference in the Linux kernel during error handling for a failed allocation. The provided information does not establish privilege requirements, remote reachability, or any impact beyond the kernel fault.
What can be done if the fix cannot be applied immediately?
No specific workaround or configuration mitigation is provided. The trigger depends on an allocation failure in the power-sequencing unit dependency setup path.