CVE-2026-97484

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usbip: vhci_hcd: fix NULL deref in status_show_vhci

platform_get_drvdata() can return NULL if a VHCI host controller's

probe failed (e.g. due to USB bus number exhaustion). status_show_vhci()

checked for a NULL pdev but not for a NULL hcd returned by

platform_get_drvdata(). Passing NULL to hcd_to_vhci_hcd() does not

return NULL - it returns a pointer offset of 0x260, causing a NULL

pointer dereference when that value is subsequently dereferenced.

Add a NULL check on hcd before calling hcd_to_vhci_hcd(). Move

status_show_not_ready() above status_show_vhci() to make it callable

from the new error path without a forward declaration.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References