CVE-2026-98841

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

virt: vmgenid: set driver_data before registering notification handlers

Both probe paths register their notification handler before assigning

driver_data, which the handler dereferences.

In the devicetree path, the notification IRQ can fire as soon as

devm_request_irq() registers the handler: the interrupt may already be

pending at probe time, for example when a VMM injects the

generation-changed notification while restoring a guest from a snapshot

that was taken before the driver had probed (Firecracker does exactly

this on snapshot restore). The IRQ is also requested with IRQF_SHARED,

so another device sharing the line can trigger the handler just as

early. The handler then calls vmgenid_notify(), which dereferences the

still-NULL driver_data and panics:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010

CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.38+ #1 PREEMPT(non

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References