# CVE-2026-98876: Linux kernel host1x bus NULL pointer dereference in error teardown

Source: https://junglewise.ai/threats/cve-2026-98876-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-98876 · Severity: info · Published 2026-10-23

The Linux kernel's host1x bus driver failed to check if a client operations structure was valid before attempting to clean up resources during error handling, potentially causing a system crash. If the kernel encounters an initialization error while loading certain GPU-related drivers, it could attempt to dereference a NULL pointer and crash the system.

Technologies: [Unknown Linux kernel](https://junglewise.ai/threats/technologies/unknown-linux-kernel). Vendors: [Unknown](https://junglewise.ai/threats/vendors/unknown).

## Quick answers

**Is CVE-2026-98876 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-98876 being exploited in the wild.

**How severe is CVE-2026-98876?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** Unknown Linux kernel Affected versions prior to commit 71d25f668bc5c0f36ea843462e12307dea45aaa3.

**Is there a fix for CVE-2026-98876?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-98876 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-98876?** Check whether you run Unknown Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The host1x_device_init() function in drivers/gpu/host1x/bus.c lacks NULL checks on client->ops in its error teardown paths (teardown and teardown_late labels), unlike the forward init paths which guard with 'client->ops &&'. A NULL pointer dereference can occur if client->ops is NULL during error teardown, requiring a NULL check to be added before dereferencing client->ops->exit and client->ops->late_exit.

## Affected products

- <UNKNOWN> Linux kernel Affected versions prior to commit 71d25f668bc5c0f36ea843462e12307dea45aaa3

## Timeline

- 2026-10-23: disclosed

## References

- [https://git.kernel.org/stable/c/29375e071ea201fe97bafe1d2ad9d9f30311abfb](https://git.kernel.org/stable/c/29375e071ea201fe97bafe1d2ad9d9f30311abfb)
- [https://git.kernel.org/stable/c/62851e7b0e55de6fe08da08bc41fd587fbcb0e9b](https://git.kernel.org/stable/c/62851e7b0e55de6fe08da08bc41fd587fbcb0e9b)

## Related threats

- [Linux kernel netfilter nft_byteorder multi-register bypass](https://junglewise.ai/threats/cve-2026-99285-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel GPIO null pointer dereference in shared GPIO lookup](https://junglewise.ai/threats/cve-2026-99257-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel NTFS race condition in page fault handler](https://junglewise.ai/threats/cve-2026-99241-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel i915 DMC firmware load address validation bypass](https://junglewise.ai/threats/cve-2026-99146-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel dm-integrity buffer overflow in inline mode](https://junglewise.ai/threats/cve-2026-99098-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)