Description
In the Linux kernel, the following vulnerability has been resolved:

virt: vmgenid: set driver_data before registering notification handlers

Both probe paths register their notification handler before assigning
driver_data, which the handler dereferences.

In the devicetree path, the notification IRQ can fire as soon as
devm_request_irq() registers the handler: the interrupt may already be
pending at probe time, for example when a VMM injects the
generation-changed notification while restoring a guest from a snapshot
that was taken before the driver had probed (Firecracker does exactly
this on snapshot restore). The IRQ is also requested with IRQF_SHARED,
so another device sharing the line can trigger the handler just as
early. The handler then calls vmgenid_notify(), which dereferences the
still-NULL driver_data and panics:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.38+ #1 PREEMPT(none)
Hardware name: linux,dummy-virt (DT)
pc : vmgenid_notify.isra.0+0x24/0x8c
lr : vmgenid_of_irq_handler+0x14/0x34
Call trace:
vmgenid_notify.isra.0+0x24/0x8c (P)
vmgenid_of_irq_handler+0x14/0x34
__handle_irq_event_percpu+0x44/0x1bc
handle_irq_event+0x4c/0xb4
handle_fasteoi_irq+0xf8/0x1f8

The ACPI path has the same ordering problem: the handler is installed
with acpi_install_notify_handler() before driver_data is assigned.
ACPI notifications are dispatched asynchronously from a workqueue, so
the window is narrow, but a notification arriving between the two calls
hits the same NULL dereference.

Assign driver_data before registering the handlers. The state is fully
initialized at that point, so the handlers are safe to run. Should
registration fail, the probe error path leaves no dangling pointer
behind: the driver core clears driver_data in device_unbind_cleanup().
Published: 2026-10-18
Score: 4.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Kernel Panic Leading to DoS
Action: Apply Patch
AI Analysis

Impact

The vmgenid driver in the Linux kernel assigns driver_data after registering its notification handlers, causing a NULL pointer dereference when the handler executes before driver_data is initialized. This flaw is a NULL pointer dereference (CWE-476). This results in a kernel panic that can crash the host and all virtual machines it manages.

Affected Systems

Linux kernel images that contain the vmgenid driver and have not yet applied the patch. Distributions shipping kernels before the fix are affected.

Risk and Exploitability

The CVSS score of 4.1 indicates a moderate severity. The EPSS score of <1% shows that public exploitation is unlikely, and the vulnerability is not listed in CISA KEV. Exploitation requires a notification to fire before driver_data is set – a scenario that can occur during VM snapshot restores or via shared IRQ lines. While the trigger window is narrow, a successful attack leads to a severe denial of service through a kernel panic.

Generated by OpenCVE AI on October 24, 2026 at 02:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version where driver_data is set before registering notification handlers, i.e., after the patch has been applied.
  • If an immediate kernel update is not feasible, disable the vmgenid driver or its notification mechanisms by removing the driver from the configuration or setting kernel parameters to prevent registration of the notification handlers, thereby avoiding the NULL pointer dereference that causes the kernel panic.
  • For environments using hypervisors such as Firecracker, ensure that snapshot restore does not trigger generation‑changed notifications before the driver is fully initialized, or use virtual machine images that do not depend on vmgenid notifications during restore.

Generated by OpenCVE AI on October 24, 2026 at 02:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4850-1 linux-6.12 security update
History

Sat, 24 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sun, 18 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driver_data before registering notification handlers Both probe paths register their notification handler before assigning driver_data, which the handler dereferences. In the devicetree path, the notification IRQ can fire as soon as devm_request_irq() registers the handler: the interrupt may already be pending at probe time, for example when a VMM injects the generation-changed notification while restoring a guest from a snapshot that was taken before the driver had probed (Firecracker does exactly this on snapshot restore). The IRQ is also requested with IRQF_SHARED, so another device sharing the line can trigger the handler just as early. The handler then calls vmgenid_notify(), which dereferences the still-NULL driver_data and panics: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.38+ #1 PREEMPT(none) Hardware name: linux,dummy-virt (DT) pc : vmgenid_notify.isra.0+0x24/0x8c lr : vmgenid_of_irq_handler+0x14/0x34 Call trace: vmgenid_notify.isra.0+0x24/0x8c (P) vmgenid_of_irq_handler+0x14/0x34 __handle_irq_event_percpu+0x44/0x1bc handle_irq_event+0x4c/0xb4 handle_fasteoi_irq+0xf8/0x1f8 The ACPI path has the same ordering problem: the handler is installed with acpi_install_notify_handler() before driver_data is assigned. ACPI notifications are dispatched asynchronously from a workqueue, so the window is narrow, but a notification arriving between the two calls hits the same NULL dereference. Assign driver_data before registering the handlers. The state is fully initialized at that point, so the handlers are safe to run. Should registration fail, the probe error path leaves no dangling pointer behind: the driver core clears driver_data in device_unbind_cleanup().
Title virt: vmgenid: set driver_data before registering notification handlers
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:26:33.492Z

Reserved: 2026-09-25T10:25:14.373Z

Link: CVE-2026-98841

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:38.417

Modified: 2026-10-19T10:19:48.197

Link: CVE-2026-98841

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98841 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T03:00:11Z

Weaknesses