CVE-2026-98496

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98496", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.353Z", "datePublished": "2026-10-18T15:16:27.545Z", "dateUpdated": "2026-10-19T09:20:33.996Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:20:33.996Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: npu: cancel wdt_work after releasing the WDT IRQ\n\nairoha_npu_remove() calls cancel_work_sync() on each core's wdt_work,\nbut the watchdog IRQ that queues it is requested with devm_request_irq()\nand is freed only after .remove() returns. airoha_npu_wdt_handler() can\ntherefore schedule_work() again once the cancel has returned. struct\nairoha_npu, which contains the work, is devm_kzalloc()'d and is freed in\nthat same unwind, so the late work dereferences freed memory.\n\nRegister the work with devm_work_autocancel() before devm_request_irq()\nand drop .remove(). Devres runs in reverse order, so the IRQ is freed\nbefore cancel_work_sync(), including when probe fails. A cancel left in\n.remove() cannot get that order. Initializing the work first also stops\na pending watchdog interrupt from queuing an uninitialized work item.\nProbe currently calls INIT_WORK() only after devm_request_irq().\n\nThis issue was identified during our ongoing static-analysis research\nwhile reviewing kernel code."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/airoha/airoha_npu.c"], "versions": [{"version": "23290c7bc190def4e1ca61610992d9b7c32e33f3", "lessThan": "aca91d8fa0ecbc990ebf9a688c684dda78a43c00", "status": "affected", "versionType": "git"}, {"version": "23290c7bc190def4e1ca61610992d9b7c32e33f3", "lessThan": "da9d42531f3a6dfea2e9c775b62a46185dbf280a", "status": "affected", "versionType": "git"}, {"version": "23290c7bc190def4e1ca61610992d9b7c32e33f3", "lessThan": "4bdee8060d1e4581624e68fbd369b1afb14df4bc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/airoha/airoha_npu.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/aca91d8fa0ecbc990ebf9a688c684dda78a43c00"}, {"url": "https://git.kernel.org/stable/c/da9d42531f3a6dfea2e9c775b62a46185dbf280a"}, {"url": "https://git.kernel.org/stable/c/4bdee8060d1e4581624e68fbd369b1afb14df4bc"}], "title": "net: airoha: npu: cancel wdt_work after releasing the WDT IRQ", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/airoha/airoha_npu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "aca91d8fa0ecbc990ebf9a688c684dda78a43c00", "status": "affected", "version": "23290c7bc190def4e1ca61610992d9b7c32e33f3", "versionType": "git"}, {"lessThan": "da9d42531f3a6dfea2e9c775b62a46185dbf280a", "status": "affected", "version": "23290c7bc190def4e1ca61610992d9b7c32e33f3", "versionType": "git"}, {"lessThan": "4bdee8060d1e4581624e68fbd369b1afb14df4bc", "status": "affected", "version": "23290c7bc190def4e1ca61610992d9b7c32e33f3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/airoha/airoha_npu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: npu: cancel wdt_work after releasing the WDT IRQ\n\nairoha_npu_remove() calls cancel_work_sync() on each core's wdt_work,\nbut the watchdog IRQ that queues it is requested with devm_request_irq()\nand is freed only after .remove() returns. airoha_npu_wdt_handler() can\ntherefore schedule_work() again once the cancel has returned. struct\nairoha_npu, which contains the work, is devm_kzalloc()'d and is freed in\nthat same unwind, so the late work dereferences freed memory.\n\nRegister the work with devm_work_autocancel() before devm_request_irq()\nand drop .remove(). Devres runs in reverse order, so the IRQ is freed\nbefore cancel_work_sync(), including when probe fails. A cancel left in\n.remove() cannot get that order. Initializing the work first also stops\na pending watchdog interrupt from queuing an uninitialized work item.\nProbe currently calls INIT_WORK() only after devm_request_irq().\n\nThis issue was identified during our ongoing static-analysis research\nwhile reviewing kernel code."}], "id": "CVE-2026-98496", "lastModified": "2026-10-19T10:19:02.170", "metrics": {}, "published": "2026-10-18T16:17:00.590", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4bdee8060d1e4581624e68fbd369b1afb14df4bc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aca91d8fa0ecbc990ebf9a688c684dda78a43c00"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/da9d42531f3a6dfea2e9c775b62a46185dbf280a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: airoha: npu: cancel wdt_work after releasing the WDT IRQ", "id": "2554838", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554838"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: airoha: npu: cancel wdt_work after releasing the WDT IRQ\nairoha_npu_remove() calls cancel_work_sync() on each core's wdt_work,\nbut the watchdog IRQ that queues it is requested with devm_request_irq()\nand is freed only after .remove() returns. airoha_npu_wdt_handler() can\ntherefore schedule_work() again once the cancel has returned. struct\nairoha_npu, which contains the work, is devm_kzalloc()'d and is freed in\nthat same unwind, so the late work dereferences freed memory.\nRegister the work with devm_work_autocancel() before devm_request_irq()\nand drop .remove(). Devres runs in reverse order, so the IRQ is freed\nbefore cancel_work_sync(), including when probe fails. A cancel left in\n.remove() cannot get that order. Initializing the work first also stops\na pending watchdog interrupt from queuing an uninitialized work item.\nProbe currently calls INIT_WORK() only after devm_request_irq().\nThis issue was identified during our ongoing static-analysis research\nwhile reviewing kernel code.", "A flaw was found in the Linux kernel's Airoha Neural Processing Unit (NPU) driver. During device unbinding or driver removal, an interrupt timing issue allows watchdog tasks to be scheduled after cleanup procedures have completed. A local user with administrative privileges could trigger this flaw to cause a use-after-free condition, leading to a Denial of Service (DoS) through a system crash or potential memory corruption."], "name": "CVE-2026-98496", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98496\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98496\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98496.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[23290c7bc190def4e1ca61610992d9b7c32e33f3,aca91d8fa0ecbc990ebf9a688c684dda78a43c00)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[23290c7bc190def4e1ca61610992d9b7c32e33f3,da9d42531f3a6dfea2e9c775b62a46185dbf280a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[23290c7bc190def4e1ca61610992d9b7c32e33f3,4bdee8060d1e4581624e68fbd369b1afb14df4bc)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T17:45:06.375060+00:00", "updated": "2026-10-22T22:45:13.862078+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416", "CWE-825"]}