CVE-2026-98411

A flaw was found in the Linux kernel's power sequencing subsystem. When device registration encounters a naming failure, the error-handling path attempts to clean up data structures before they are initialized. This issue leads to an invalid pointer dereference, which can cause the kernel to crash and result in a Denial of Service (DoS).

A moderate-impact denial of service flaw was found in the Linux kernel power sequencing subsystem shipped in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. In pwrseq_device_register(), a failure of dev_set_name() jumps to the error cleanup path before the pwrseq->targets list head is initialized; pwrseq_release() then unconditionally iterates over targets and dereferences an invalid pointer, causing a kernel crash. Triggering the flaw requires local access and high privileges to reach power sequencing device registration, and it further depends on an uncommon failure of dev_set_name() such as a memory allocation error, so the practical likelihood of exploitation is low and the impact is limited to availability (Red Hat CVSS 3.1: 4.1, AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

The kernel packages in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 contain the vulnerable code and are affected; fixes are currently deferred for these products. The residual risk of deferral is low: the flaw is reachable only through a rare error path that requires privileged local action, and its worst outcome is a kernel crash (denial of service) with no impact on confidentiality or integrity. Red Hat Enterprise Linux 6, 7, 8, and 9 kernels, including their real-time (kernel-rt) variants, and the RHEL CoreOS kernels shipped with OpenShift Container Platform are not affected because the vulnerable code is not present in those kernel versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.