PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45978 Linux CVE debrief

A NULL pointer dereference vulnerability exists in the Linux kernel's Greybus staging driver, specifically in the lights subsystem. The flaw occurs in gb_lights_light_config() where channel_count is stored before the channels array is allocated via kcalloc(). If the allocation fails, gb_lights_release() iterates using the non-zero channel_count and dereferences the NULL light->channels pointer. The fix reorders operations to allocate channels first, then publish channel_count only after successful allocation, preventing the cleanup path from walking a NULL pointer. This vulnerability affects kernel versions prior to the patched releases.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Linux kernel maintainers, embedded systems developers using Greybus hardware, Android device manufacturers with modular accessory support, and security teams tracking kernel staging driver vulnerabilities

Technical summary

The vulnerability is a classic initialization ordering bug in the Greybus lights driver (drivers/staging/greybus/lights.c). The function gb_lights_light_config() sets light->channels_count from protocol data before allocating light->channels. If kcalloc() fails, the error path calls gb_lights_release(), which uses channels_count in a loop to release channel resources, dereferencing the unallocated NULL pointer. The fix ensures atomicity of allocation and count publication: allocate first, then assign count only on success. This prevents the release function from observing inconsistent state.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches when available for your distribution
  • Monitor vendor security advisories for kernel updates addressing CVE-2026-45978
  • Review systems using Greybus hardware for staging driver exposure
  • Prioritize patching on systems with untrusted physical access or modular kernel loading
  • Validate kcalloc failure handling in custom kernel builds if maintaining out-of-tree Greybus drivers

Evidence notes

Vulnerability description and patch commits sourced from NVD and kernel.org stable trees. Multiple stable branch fixes identified.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45978 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45978

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45978 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45978

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/01b91cb3e748032fd96bbe0043812b426a52f091

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/06162d85f830582da6e9e5fcf9c9504d6da9ae0b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3cbe694d235d96f628ec7dc6ae4d8bdddb768699

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/65f2c608096d766540953d9b170d216aa3b5eb95

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a118724d7641b832fa14323e2733e28ae4834552

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ba5022162da63059bae36c4fd84d7031f582c71f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/da46264a7016034a5bbbad034c012ef218b7d0af

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.