{"cve":"CVE-2026-98202","nvd":{"published":"2026-10-06T09:18:06.067","modified":"2026-10-19T10:18:20.847","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - fix GPF in suspend and resume when unbound\n\nTransport drivers (such as rmi_i2c and rmi_spi) invoke\nrmi_driver_suspend() and rmi_driver_resume() on their child rmi_dev\ndevice during system power management events. However, transport drivers\nare fully registered and operational even if the physical RMI driver\nfailed to bind or probe the rmi_dev device.\n\nWhen rmi_driver_suspend() or rmi_driver_resume() is called on an unbound\nrmi_dev, dev_get_drvdata() returns NULL. Calling rmi_disable_irq() or\nrmi_enable_irq() without driver data attached causes a NULL pointer\ndereference and General Protection Fault when attempting to lock\ndata->enabled_mutex.\n\nFix this by checking if driver data is attached to rmi_dev in\nrmi_driver_suspend() and rmi_driver_resume(), exiting early if\nno driver data is present.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/30366f507ce3e408caf7f7375bb343df54b9a4f9","https://git.kernel.org/stable/c/7a3d7c68aa36f68e2a4824da4782c0e5d7c4eba4","https://git.kernel.org/stable/c/84145a4a1dc58f8959811913c5f61f3235dd9f6c","https://git.kernel.org/stable/c/942b06a19252908d0f952c0590caf20e47f88252","https://git.kernel.org/stable/c/e2b6703465c1ce43edb91c1626604b7092b3c431"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:57:46.668721662+00:00"},"epss":{"cve":"CVE-2026-98202","score":0.00177,"percentile":0.07144,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}