CVE-2026-98665: iio: health: max30102: fix NULL dereference in interrupt handler
In the Linux kernel, the following vulnerability has been resolved:
iio: health: max30102: fix NULL dereference in interrupt handler
The interrupt is requested in max30102probe() and stays enabled for the lifetime of the device, but indiodev->activescanmask is only valid while a buffer is enabled. When an interrupt arrives while no buffer is enabled, the handler dereferences the NULL activescanmask:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: bitmapweight+0x64/0x98 (P) max30102interrupthandler+0x48/0x160 [max30102]
Call max30102fifocount() at the top of the handler and return early unless it reports a FIFO sample is ready. Because FIFORDY is the only interrupt source enabled in max30102chipinit(), an invocation of max30102interrupthandler() without the FIFORDY interrupt status bit set carries no data to read and can return before touching activescanmask. A negative return from max30102fifocount() indicates a failed interrupt status read and is treated the same way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In max30102_interrupt_handler(), call max30102_fifo_count() at the top and return early when it reports a negative value or no FIFO sample is ready, before accessing indio_dev->active_scan_mask.