CVE-2026-98665

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iio: health: max30102: fix NULL dereference in interrupt handler

The interrupt is requested in max30102_probe() and stays enabled

for the lifetime of the device, but indio_dev->active_scan_mask is only

valid while a buffer is enabled. When an interrupt arrives while no

buffer is enabled, the handler dereferences the NULL active_scan_mask:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000

Call trace:

__bitmap_weight+0x64/0x98 (P)

max30102_interrupt_handler+0x48/0x160 [max30102]

Call max30102_fifo_count() at the top of the handler and return early

unless it reports a FIFO sample is ready. Because FIFO_RDY is the only

interrupt source enabled in max30102_chip_init(), an invocation of

max30102_interrupt_handler() without the FIFO_RDY interrupt status bit

set carries no data to read and can return before touching

active_scan_mask. A negative return from max30102_fifo_count()

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References