{"id":"CVE-2026-97484","published":"2026-09-24T17:17:25.933","lastModified":"2026-09-28T06:16:34.397","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: vhci_hcd: fix NULL deref in status_show_vhci\n\nplatform_get_drvdata() can return NULL if a VHCI host controller's\nprobe failed (e.g. due to USB bus number exhaustion). status_show_vhci()\nchecked for a NULL pdev but not for a NULL hcd returned by\nplatform_get_drvdata(). Passing NULL to hcd_to_vhci_hcd() does not\nreturn NULL - it returns a pointer offset of 0x260, causing a NULL\npointer dereference when that value is subsequently dereferenced.\n\nAdd a NULL check on hcd before calling hcd_to_vhci_hcd(). Move\nstatus_show_not_ready() above status_show_vhci() to make it callable\nfrom the new error path without a forward declaration.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/046a94fdb02eb1df86c8fa4614104ff801ba3ab7","tags":[]},{"url":"https://git.kernel.org/stable/c/bc150783542ba2e7c1257d1299c6f3269bdba270","tags":[]},{"url":"https://git.kernel.org/stable/c/dacd7c317ba12e035653c28a0eaaf23d91abc073","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}