CVE-2026-97484

Status: UPDATED  |  Advisory ID: CVE-2026-97484

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

usbip: vhci_hcd: fix NULL deref in status_show_vhci

platform_get_drvdata() can return NULL if a VHCI host controller's

probe failed (e.g. due to USB bus number exhaustion). status_show_vhci()

checked for a NULL pdev but not for a NULL hcd returned by

platform_get_drvdata(). Passing NULL to hcd_to_vhci_hcd() does not

return NULL - it returns a pointer offset of 0x260, causing a NULL

pointer dereference when that value is subsequently dereferenced.

Add a NULL check on hcd before calling hcd_to_vhci_hcd(). Move

status_show_not_ready() above status_show_vhci() to make it callable

from the new error path without a forward declaration. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References