CVE-2026-97484 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, usbip vhci_hcd module users, and security teams responsible for vulnerability management and patch application. They should prioritize patch application, assess VHCI host controller probe failure exposure, and implement additional NULL checks for hcd.

Why it matters

This vulnerability requires verification of Linux kernel patch application and assessment of VHCI host controller probe failure exposure. Linux kernel developers and maintainers should prioritize patch application and implement additional NULL checks for hcd.

• Verification of Linux kernel patch application priority
• Assessment of VHCI host controller probe failure exposure
• Implementation of additional NULL checks for hcd

Technical summary

The Linux kernel's usbip vhci_hcd module is vulnerable to a NULL pointer dereference. When a VHCI host controller's probe fails, platform_get_drvdata() returns NULL. However, the status_show_vhci() function does not check for NULL before calling hcd_to_vhci_hcd(), leading to a NULL pointer dereference. The vulnerability requires verification of Linux kernel patch application and assessment of VHCI host controller probe failure exposure. Linux kernel developers and maintainers should prioritize patch application and implement additional NULL checks for hcd.

Defensive priority

Medium

Recommended defensive actions

• Review Linux kernel patch commits for usbip vhci_hcd module updates
• Assess VHCI host controller probe failure scenarios
• Implement additional NULL checks for hcd in status_show_vhci
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify affected or fixed versions. The Linux kernel patch commits are provided. Evidence is limited, and defenders should verify patch application and assess VHCI host controller probe failure exposure. Additional NULL checks for hcd should be implemented. The vulnerability has a medium defensive priority.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.