CVE-2026-98203

A flaw was found in the Linux kernel's SoC (System on Chip) button array driver. The driver fails to verify that the button descriptor package contains entries before accessing them during device initialization. This issue may allow an invalid device configuration to trigger an out-of-bounds memory access, resulting in a kernel crash and Denial of Service (DoS).

A low impact out-of-bounds read flaw was found in the Linux kernel's soc_button_array driver used on SoC (System on Chip) platforms. The driver fails to verify that the ACPI button descriptor package contains any elements before accessing btns_desc->package.elements[0], so a device presenting a malformed ACPI configuration with a zero-length button descriptor package can trigger an out-of-bounds kernel memory read during device initialization, resulting in a driver probe failure or a kernel crash (denial of service). The flaw is local and not network reachable, and reliable triggering generally requires control over the platform's ACPI/firmware configuration or boot environment; this is why Red Hat rates the issue LOW impact even though the Red Hat CVSS:3.1 availability score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 10 kernels and Red Hat In-Vehicle OS 2 kernels (including kernel-ivos-qualcomm) are affected; the fix is currently deferred because this is a low-severity availability issue in device initialization, and the residual risk is limited to a local denial of service on systems whose ACPI button descriptor data is malformed or maliciously crafted. Red Hat Enterprise Linux 6, 7, 8, and 9 kernels (kernel and kernel-rt) and the RHEL CoreOS kernels used in OpenShift Container Platform are not affected because the vulnerable code is not present in those releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.