CVE-2026-98412

A flaw was found in the Linux kernel's power sequencing subsystem. If a memory allocation failure occurs while setting up dependencies in pwrseq_unit_setup_deps(), error handling cleans up the partially allocated unit without having initialized its internal list. This uninitialized state leads to a NULL pointer dereference during cleanup, causing a kernel crash and resulting in a Denial of Service (DoS).

A flaw of moderate impact was found in the Linux kernel power sequencing subsystem (drivers/power/sequencing/core.c) as shipped in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. If a memory allocation fails while setting up unit dependencies in pwrseq_unit_setup_deps(), the error path releases the partially initialized unit, and pwrseq_unit_release() unconditionally calls list_del() on the unit's not-yet-initialized list, causing a NULL pointer dereference that crashes the kernel (denial of service). Exploiting this requires privileged local access to the system and depends on an unexpected memory allocation failure during power sequencing unit setup, which is reflected in the Red Hat CVSS 3.1 score of 4.1 (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H); only availability is impacted. Fixes for the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 kernels are deferred to a future planned update because this is a low-severity, hard-to-trigger error-path defect; the residual risk is that a local privileged user who can induce the allocation failure could crash the system. Earlier Red Hat Enterprise Linux versions (including kernel and kernel-rt in RHEL 6 through 9) and the OpenShift Container Platform RHEL CoreOS images are not affected because the vulnerable code, introduced upstream in the 6.11 kernel, is not present in those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.