CVE-2026-98657

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98657", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.362Z", "datePublished": "2026-10-18T15:44:09.808Z", "dateUpdated": "2026-10-30T12:38:29.218Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:38:29.218Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: proximity: pulsedlight: fix iio_device left registered on PM setup failure\n\npm_runtime_set_active() failing in probe() jumps to error_unreg_buffer,\nwhich only calls iio_triggered_buffer_cleanup() -- it does not undo the\niio_device_register() that already succeeded a few lines above. probe()\nthen returns the error, the devm-managed indio_dev is freed, but the\niio core still has it registered: the sysfs/chardev nodes stay live and\npoint at freed memory.\n\nAdd an error_unreg_dev label that unregisters the iio device before\nfalling through to the existing buffer cleanup, mirroring the teardown\norder already used in lidar_remove()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iio/proximity/pulsedlight-lidar-lite-v2.c"], "versions": [{"version": "4ac4e086fd8c59e6b69089e6f7605500b63a6d17", "lessThan": "93ecee9ff3af4c2b482fdd4ec98c3308e8dd23a6", "status": "affected", "versionType": "git"}, {"version": "4ac4e086fd8c59e6b69089e6f7605500b63a6d17", "lessThan": "58e68e5272a319fff4a704df1ac41e9e3c69587c", "status": "affected", "versionType": "git"}, {"version": "4ac4e086fd8c59e6b69089e6f7605500b63a6d17", "lessThan": "4a564e39cb99234e8c5b0a39aa30edcc8cf4cf1b", "status": "affected", "versionType": "git"}, {"version": "4ac4e086fd8c59e6b69089e6f7605500b63a6d17", "lessThan": "2c8211eef98929c5188f8c2224e83b9a63b41bd1", "status": "affected", "versionType": "git"}, {"version": "4ac4e086fd8c59e6b69089e6f7605500b63a6d17", "lessThan": "06fa13c53442257b94ea1519555ceddaaea57e0d", "status": "affected", "versionType": "git"}, {"version": "4ac4e086fd8c59e6b69089e6f7605500b63a6d17", "lessThan": "20ebd7f4e35c0a737f011bc83aeb0cdd37507648", "status": "affected", "versionType": "git"}, {"version": "4ac4e086fd8c59e6b69089e6f7605500b63a6d17", "lessThan": "e462b47b9637b8c0285f4a38b5af9a322847d164", "status": "affected", "versionType": "git"}, {"version": "4ac4e086fd8c59e6b69089e6f7605500b63a6d17", "lessThan": "4daa9ca557b4b98ae1ad38a6d1deaa3e31eb8edf", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iio/proximity/pulsedlight-lidar-lite-v2.c"], "versions": [{"version": "4.5", "status": "affected"}, {"version": "0", "lessThan": "4.5", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/93ecee9ff3af4c2b482fdd4ec98c3308e8dd23a6"}, {"url": "https://git.kernel.org/stable/c/58e68e5272a319fff4a704df1ac41e9e3c69587c"}, {"url": "https://git.kernel.org/stable/c/4a564e39cb99234e8c5b0a39aa30edcc8cf4cf1b"}, {"url": "https://git.kernel.org/stable/c/2c8211eef98929c5188f8c2224e83b9a63b41bd1"}, {"url": "https://git.kernel.org/stable/c/06fa13c53442257b94ea1519555ceddaaea57e0d"}, {"url": "https://git.kernel.org/stable/c/20ebd7f4e35c0a737f011bc83aeb0cdd37507648"}, {"url": "https://git.kernel.org/stable/c/e462b47b9637b8c0285f4a38b5af9a322847d164"}, {"url": "https://git.kernel.org/stable/c/4daa9ca557b4b98ae1ad38a6d1deaa3e31eb8edf"}], "title": "iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/iio/proximity/pulsedlight-lidar-lite-v2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "93ecee9ff3af4c2b482fdd4ec98c3308e8dd23a6", "status": "affected", "version": "4ac4e086fd8c59e6b69089e6f7605500b63a6d17", "versionType": "git"}, {"lessThan": "58e68e5272a319fff4a704df1ac41e9e3c69587c", "status": "affected", "version": "4ac4e086fd8c59e6b69089e6f7605500b63a6d17", "versionType": "git"}, {"lessThan": "4a564e39cb99234e8c5b0a39aa30edcc8cf4cf1b", "status": "affected", "version": "4ac4e086fd8c59e6b69089e6f7605500b63a6d17", "versionType": "git"}, {"lessThan": "2c8211eef98929c5188f8c2224e83b9a63b41bd1", "status": "affected", "version": "4ac4e086fd8c59e6b69089e6f7605500b63a6d17", "versionType": "git"}, {"lessThan": "06fa13c53442257b94ea1519555ceddaaea57e0d", "status": "affected", "version": "4ac4e086fd8c59e6b69089e6f7605500b63a6d17", "versionType": "git"}, {"lessThan": "20ebd7f4e35c0a737f011bc83aeb0cdd37507648", "status": "affected", "version": "4ac4e086fd8c59e6b69089e6f7605500b63a6d17", "versionType": "git"}, {"lessThan": "e462b47b9637b8c0285f4a38b5af9a322847d164", "status": "affected", "version": "4ac4e086fd8c59e6b69089e6f7605500b63a6d17", "versionType": "git"}, {"lessThan": "4daa9ca557b4b98ae1ad38a6d1deaa3e31eb8edf", "status": "affected", "version": "4ac4e086fd8c59e6b69089e6f7605500b63a6d17", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/iio/proximity/pulsedlight-lidar-lite-v2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.5"}, {"lessThan": "4.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: proximity: pulsedlight: fix iio_device left registered on PM setup failure\n\npm_runtime_set_active() failing in probe() jumps to error_unreg_buffer,\nwhich only calls iio_triggered_buffer_cleanup() -- it does not undo the\niio_device_register() that already succeeded a few lines above. probe()\nthen returns the error, the devm-managed indio_dev is freed, but the\niio core still has it registered: the sysfs/chardev nodes stay live and\npoint at freed memory.\n\nAdd an error_unreg_dev label that unregisters the iio device before\nfalling through to the existing buffer cleanup, mirroring the teardown\norder already used in lidar_remove()."}], "id": "CVE-2026-98657", "lastModified": "2026-10-30T13:21:16.460", "metrics": {}, "published": "2026-10-18T16:17:19.013", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/06fa13c53442257b94ea1519555ceddaaea57e0d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/20ebd7f4e35c0a737f011bc83aeb0cdd37507648"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2c8211eef98929c5188f8c2224e83b9a63b41bd1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4a564e39cb99234e8c5b0a39aa30edcc8cf4cf1b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4daa9ca557b4b98ae1ad38a6d1deaa3e31eb8edf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/58e68e5272a319fff4a704df1ac41e9e3c69587c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/93ecee9ff3af4c2b482fdd4ec98c3308e8dd23a6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e462b47b9637b8c0285f4a38b5af9a322847d164"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure", "id": "2555191", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555191"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\niio: proximity: pulsedlight: fix iio_device left registered on PM setup failure\npm_runtime_set_active() failing in probe() jumps to error_unreg_buffer,\nwhich only calls iio_triggered_buffer_cleanup() -- it does not undo the\niio_device_register() that already succeeded a few lines above. probe()\nthen returns the error, the devm-managed indio_dev is freed, but the\niio core still has it registered: the sysfs/chardev nodes stay live and\npoint at freed memory.\nAdd an error_unreg_dev label that unregisters the iio device before\nfalling through to the existing buffer cleanup, mirroring the teardown\norder already used in lidar_remove().", "A flaw was found in the Linux kernel's PulsedLight LIDAR sensor driver. When device initialization fails during power management setup, the driver fails to properly unregister the device before releasing its allocated memory. This leaves active system interfaces pointing to released memory, creating a use-after-free condition where the system references deallocated resources. A local user could interact with these lingering device interfaces to potentially execute arbitrary code or cause a Denial of Service (DoS) by crashing the system."], "name": "CVE-2026-98657", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98657\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98657\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98657.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ac4e086fd8c59e6b69089e6f7605500b63a6d17,06fa13c53442257b94ea1519555ceddaaea57e0d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ac4e086fd8c59e6b69089e6f7605500b63a6d17,20ebd7f4e35c0a737f011bc83aeb0cdd37507648)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ac4e086fd8c59e6b69089e6f7605500b63a6d17,e462b47b9637b8c0285f4a38b5af9a322847d164)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ac4e086fd8c59e6b69089e6f7605500b63a6d17,4daa9ca557b4b98ae1ad38a6d1deaa3e31eb8edf)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.5,4.5]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.5)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T23:00:12.909944+00:00", "updated": "2026-10-23T07:00:17.010138+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}