CVE-2026-98665

In the Linux kernel, the following vulnerability has been resolved:

iio: health: max30102: fix NULL dereference in interrupt handler

The interrupt is requested in max30102 probe() and stays enabled for the lifetime of the device, but indio dev->active scan mask is only valid while a buffer is enabled. When an interrupt arrives while no buffer is enabled, the handler dereferences the NULL active scan mask:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: bitmap weight+0x64/0x98 (P) max30102 interrupt handler+0x48/0x160 [max30102]

Call max30102 fifo count() at the top of the handler and return early unless it reports a FIFO sample is ready. Because FIFO RDY is the only interrupt source enabled in max30102 chip init(), an invocation of max30102 interrupt handler() without the FIFO RDY interrupt status bit set carries no data to read and can return before touching active scan mask. A negative return from max30102 fifo count() indicates a failed interrupt status read and is treated the same way.