CVE-2026-98202

Red Hat rates the impact of this flaw as Low. A NULL pointer dereference flaw was found in the Linux kernel's Synaptics RMI4 input driver. RMI4 transport drivers (such as rmi_i2c and rmi_spi) invoke rmi_driver_suspend() and rmi_driver_resume() on the rmi_dev device during system power management events, and those transport drivers remain fully registered and operational even when the RMI physical driver has failed to bind or probe the rmi_dev device. When suspend or resume runs against such an unbound rmi_dev, dev_get_drvdata() returns NULL and the driver's IRQ enable/disable path dereferences it while attempting to lock data->enabled_mutex, causing a general protection fault and a kernel crash. A local attacker able to trigger system suspend or resume on a system with an unbound RMI4 device can therefore cause a denial of service; there is no impact on confidentiality or integrity. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that stream, while the affected Red Hat Enterprise Linux (kernel and kernel-rt), Red Hat In-Vehicle OS, and OpenShift Container Platform (RHEL CoreOS) kernel streams contain the vulnerable code. Fixes for the affected streams are currently deferred because the flaw only enables a local denial of service and reliable triggering requires the uncommon condition of an RMI4 device whose physical driver failed to bind or probe while its transport driver remained registered; the residual risk of leaving it unfixed is a potential local system crash during suspend or resume. The Red Hat impact of Low reflects a lower practical severity than the CVSS 3.1 base score of 5.5 (Moderate), which is driven solely by the high availability impact under low-likelihood conditions.