CVE-2026-98665 - Vulnerability Details

- iio: health: max30102: fix NULL dereference in interrupt handler

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: health: max30102: fix NULL dereference in interrupt handler

The interrupt is requested in max30102_probe() and stays enabled
for the lifetime of the device, but indio_dev->active_scan_mask is only
valid while a buffer is enabled. When an interrupt arrives while no
buffer is enabled, the handler dereferences the NULL active_scan_mask:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Call trace:
__bitmap_weight+0x64/0x98 (P)
max30102_interrupt_handler+0x48/0x160 [max30102]

Call max30102_fifo_count() at the top of the handler and return early
unless it reports a FIFO sample is ready. Because FIFO_RDY is the only
interrupt source enabled in max30102_chip_init(), an invocation of
max30102_interrupt_handler() without the FIFO_RDY interrupt status bit
set carries no data to read and can return before touching
active_scan_mask. A negative return from max30102_fifo_count()
indicates a failed interrupt status read and is treated the same way.

Published: 2026-10-18

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability is a NULL pointer dereference in the interrupt handler of the Linux kernel driver for the MAX30102 health sensor. When an interrupt fires while no data buffer is enabled, the handler reads an active_scan_mask that is NULL, causing an oops and a kernel crash. The issue stems from dereferencing a null pointer, categorised as CWE‑476. An attacker that can trigger such an interrupt could crash the kernel, leading to denial of service.

Affected Systems

All systems running the Linux kernel with the MAX30102 driver before the resolving commit are affected. The vendor is Linux, and the product is the Linux kernel. Because the vulnerability was tied to the MAX30102 subsystem, any distribution or device that loads this driver is potentially impacted. Specific version information is not listed, but the patch is incorporated in the kernel source after the commit referenced in the advisory.

Risk and Exploitability

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 5.5, indicating a moderate severity. The likely attack vector is local device interaction; an attacker with access to the MAX30102 sensor could trigger the interrupt that propagates the crash, though exploitation requires the conditions described in the fix. Overall, the risk is moderate until the kernel is updated.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`90579b69e94bf11ea0745ff003e82a6ce9725f96`	affected	< 2a74f30a7bb305cdc5c3e3e9239b32bb84f3529f
`90579b69e94bf11ea0745ff003e82a6ce9725f96`	affected	< eeb23ba97bd8016e815ef70300b8d34a0a316b90
`90579b69e94bf11ea0745ff003e82a6ce9725f96`	affected	< 60699102827fdb51f9591414165359c8e867f302
`90579b69e94bf11ea0745ff003e82a6ce9725f96`	affected	< 8d6f98972fe2bd6f73f39d982af0c85d766a1503
`90579b69e94bf11ea0745ff003e82a6ce9725f96`	affected	< f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d

Linux

affected

Version	Status	Constraints
`4.16`	affected	—
`0`	unaffected	< 4.16
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[90579b69e94bf11ea0745ff003e82a6ce9725f96,eeb23ba97bd8016e815ef70300b8d34a0a316b90)`	affected	code_commit	—
`[90579b69e94bf11ea0745ff003e82a6ce9725f96,60699102827fdb51f9591414165359c8e867f302)`	affected	code_commit	—
`[90579b69e94bf11ea0745ff003e82a6ce9725f96,8d6f98972fe2bd6f73f39d982af0c85d766a1503)`	affected	code_commit	—
`[90579b69e94bf11ea0745ff003e82a6ce9725f96,f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.16`	affected	generic	—
`[0,4.16)`	unaffected	generic	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest stable Linux kernel that incorporates the commit fixing the NULL dereference in the max30102 driver.
Reboot the system to load the updated kernel and driver.
Monitor system logs (e.g., dmesg, syslog) for any remaining kernel oopses related to max30102 during operational use.

Generated by OpenCVE AI on October 22, 2026 at 21:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98665.mbox
https://git.kernel.org/stable/c/2a74f30a7bb305cdc5c3e3e9239b32bb84f3529f
https://git.kernel.org/stable/c/60699102827fdb51f9591414165359c8e867f302
https://git.kernel.org/stable/c/8d6f98972fe2bd6f73f39d982af0c85d766a1503
https://git.kernel.org/stable/c/eeb23ba97bd8016e815ef70300b8d34a0a316b90
https://git.kernel.org/stable/c/f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d
https://nvd.nist.gov/vuln/detail/CVE-2026-98665
https://www.cve.org/CVERecord?id=CVE-2026-98665

History

Thu, 22 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98665.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98665 https://www.cve.org/CVERecord?id=CVE-2026-98665
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/2a74f30a7bb305cdc5c3e3e9239b32bb84f3529f

Sun, 18 Oct 2026 22:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: iio: health: max30102: fix NULL dereference in interrupt handler The interrupt is requested in max30102_probe() and stays enabled for the lifetime of the device, but indio_dev->active_scan_mask is only valid while a buffer is enabled. When an interrupt arrives while no buffer is enabled, the handler dereferences the NULL active_scan_mask: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: __bitmap_weight+0x64/0x98 (P) max30102_interrupt_handler+0x48/0x160 [max30102] Call max30102_fifo_count() at the top of the handler and return early unless it reports a FIFO sample is ready. Because FIFO_RDY is the only interrupt source enabled in max30102_chip_init(), an invocation of max30102_interrupt_handler() without the FIFO_RDY interrupt status bit set carries no data to read and can return before touching active_scan_mask. A negative return from max30102_fifo_count() indicates a failed interrupt status read and is treated the same way.
Title		iio: health: max30102: fix NULL dereference in interrupt handler
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/60699102827fdb51f9591414165359c8e867f302 https://git.kernel.org/stable/c/8d6f98972fe2bd6f73f39d982af0c85d766a1503 https://git.kernel.org/stable/c/eeb23ba97bd8016e815ef70300b8d34a0a316b90 https://git.kernel.org/stable/c/f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:44:35.323Z

Updated: 2026-10-21T12:55:30.413Z

Reserved: 2026-09-25T10:25:14.363Z

Link: CVE-2026-98665

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:19.797

Modified: 2026-10-21T13:21:35.777

Link: CVE-2026-98665

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98665 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-22T21:15:12Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object