CVE-2026-98121 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
watchdog: msc313e: Fix NULL pointer dereference in PM callbacks
msc313e_wdt_probe() doesn't set the driver data for the platform device. As a result, dev_get_drvdata() in msc313e_wdt_suspend() and msc313e_wdt_resume() will return NULL, leading to a NULL pointer dereference afterward.
Set the platform device driver data in msc313e_wdt_probe().
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel watchdog subsystem for the MSC313E SoC contains a critical initialization flaw that results in a null pointer dereference during power management operations. This vulnerability stems from an omission in the probe function, specifically within the msc313e_wdt_probe routine. When the platform device driver is initialized, it fails to associate its private data structure with the platform device using dev_set_drvdata. Consequently, when the system enters a suspended state or resumes from suspend, the kernel invokes the corresponding power management callbacks, namely msc313e_wdt_suspend and msc313e_wdt_resume. These functions rely on retrieving the driver-specific context by calling dev_get_drvdata to access necessary resources for stopping or restarting the watchdog timer. Because the initial setup was incomplete, this retrieval operation returns a null pointer instead of a valid memory address.
The immediate technical consequence of this flaw is a kernel panic due to an invalid memory access attempt. When the code attempts to dereference the null pointer returned by dev_get_drvdata within the suspend or resume paths, it triggers a segmentation fault in kernel space. This type of error typically leads to an immediate system crash or reboot, effectively causing a denial of service for any device relying on this hardware watchdog functionality. The vulnerability is particularly insidious because it does not manifest during normal runtime operation but only under specific power state transitions, making it difficult to detect through standard functional testing unless the device is subjected to suspend-resume cycles.
From a classification perspective, this issue aligns with CWE-476, which denotes a NULL pointer dereference vulnerability. In terms of attack vectors and tactical behavior within the MITRE ATT&CK framework for Enterprise or ICS, this flaw relates to TA0005 Defense Evasion and potentially impacts availability if exploited in an automated manner against embedded systems that require high uptime reliability. While often considered a stability issue rather than a direct security exploit vector for privilege escalation, the resulting denial of service can have significant operational implications for critical infrastructure or industrial control systems where continuous monitoring via hardware watchdogs is mandatory. The lack of proper initialization violates fundamental principles of safe resource management and state consistency in kernel drivers.
To mitigate this vulnerability, developers must ensure that the platform device driver data is correctly initialized during the probe phase. This involves calling dev_set_drvdata within msc313e_wdt_probe to bind the private watchdog context structure to the platform device before any other functions are registered or executed. By establishing this linkage early in the initialization sequence, subsequent calls to dev_get_drvdata will return valid pointers, thereby preventing null dereferences during power management transitions. This fix ensures that the hardware watchdog can be properly managed across all system states, maintaining both system stability and security integrity for devices dependent on this driver.