CVE-2026-98662

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98662", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.363Z", "datePublished": "2026-10-18T15:44:24.421Z", "dateUpdated": "2026-10-30T12:38:31.341Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:38:31.341Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: light: gp2ap020a00f: drain irq_work after free_irq\n\nThe threaded IRQ handler queues data->work through irq_work_queue() so\nthe trigger is polled from a per-CPU context. free_irq() does not flush\nan irq_work the handler already queued, so after gp2ap020a00f_remove()\nreturns that work may still run and call iio_trigger_poll() on data->trig,\nwhich the devm cleanup has already freed, causing a use-after-free.\n\nAdd irq_work_sync(&data->work) after free_irq() in remove() and in the\nprobe error path, mirroring commit 78601726d4a5 (\"iio: trigger: sysfs:\nfix use-after-free on remove\").\n\nFound by an in-house static analysis tool, confirmed by manual review."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iio/light/gp2ap020a00f.c"], "versions": [{"version": "bf29fbeaa13d3350ca71df70c705d8b883c45692", "lessThan": "6f2bb000493c3b4f5715b3103657393672aea05b", "status": "affected", "versionType": "git"}, {"version": "bf29fbeaa13d3350ca71df70c705d8b883c45692", "lessThan": "43fbbb9eaae5d6f45668e3c4d45508c498d6ba9c", "status": "affected", "versionType": "git"}, {"version": "bf29fbeaa13d3350ca71df70c705d8b883c45692", "lessThan": "d029639b079b28a5334f934c848d895bef0653d1", "status": "affected", "versionType": "git"}, {"version": "bf29fbeaa13d3350ca71df70c705d8b883c45692", "lessThan": "85c20d1cf3f01a506605a16c2f9ce23b9c8b114f", "status": "affected", "versionType": "git"}, {"version": "bf29fbeaa13d3350ca71df70c705d8b883c45692", "lessThan": "a36814b9fe00970116d30c3143d81e7425c4d334", "status": "affected", "versionType": "git"}, {"version": "bf29fbeaa13d3350ca71df70c705d8b883c45692", "lessThan": "cc71400bc965c0d3894a38ead3d71243400c2d5e", "status": "affected", "versionType": "git"}, {"version": "bf29fbeaa13d3350ca71df70c705d8b883c45692", "lessThan": "a1769877ff52a4f1bfb9ca535d1b5113808bd602", "status": "affected", "versionType": "git"}, {"version": "bf29fbeaa13d3350ca71df70c705d8b883c45692", "lessThan": "63213927b141085b6c8719b8037dab3074b7e0fe", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iio/light/gp2ap020a00f.c"], "versions": [{"version": "3.13", "status": "affected"}, {"version": "0", "lessThan": "3.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6f2bb000493c3b4f5715b3103657393672aea05b"}, {"url": "https://git.kernel.org/stable/c/43fbbb9eaae5d6f45668e3c4d45508c498d6ba9c"}, {"url": "https://git.kernel.org/stable/c/d029639b079b28a5334f934c848d895bef0653d1"}, {"url": "https://git.kernel.org/stable/c/85c20d1cf3f01a506605a16c2f9ce23b9c8b114f"}, {"url": "https://git.kernel.org/stable/c/a36814b9fe00970116d30c3143d81e7425c4d334"}, {"url": "https://git.kernel.org/stable/c/cc71400bc965c0d3894a38ead3d71243400c2d5e"}, {"url": "https://git.kernel.org/stable/c/a1769877ff52a4f1bfb9ca535d1b5113808bd602"}, {"url": "https://git.kernel.org/stable/c/63213927b141085b6c8719b8037dab3074b7e0fe"}], "title": "iio: light: gp2ap020a00f: drain irq_work after free_irq", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/iio/light/gp2ap020a00f.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6f2bb000493c3b4f5715b3103657393672aea05b", "status": "affected", "version": "bf29fbeaa13d3350ca71df70c705d8b883c45692", "versionType": "git"}, {"lessThan": "43fbbb9eaae5d6f45668e3c4d45508c498d6ba9c", "status": "affected", "version": "bf29fbeaa13d3350ca71df70c705d8b883c45692", "versionType": "git"}, {"lessThan": "d029639b079b28a5334f934c848d895bef0653d1", "status": "affected", "version": "bf29fbeaa13d3350ca71df70c705d8b883c45692", "versionType": "git"}, {"lessThan": "85c20d1cf3f01a506605a16c2f9ce23b9c8b114f", "status": "affected", "version": "bf29fbeaa13d3350ca71df70c705d8b883c45692", "versionType": "git"}, {"lessThan": "a36814b9fe00970116d30c3143d81e7425c4d334", "status": "affected", "version": "bf29fbeaa13d3350ca71df70c705d8b883c45692", "versionType": "git"}, {"lessThan": "cc71400bc965c0d3894a38ead3d71243400c2d5e", "status": "affected", "version": "bf29fbeaa13d3350ca71df70c705d8b883c45692", "versionType": "git"}, {"lessThan": "a1769877ff52a4f1bfb9ca535d1b5113808bd602", "status": "affected", "version": "bf29fbeaa13d3350ca71df70c705d8b883c45692", "versionType": "git"}, {"lessThan": "63213927b141085b6c8719b8037dab3074b7e0fe", "status": "affected", "version": "bf29fbeaa13d3350ca71df70c705d8b883c45692", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/iio/light/gp2ap020a00f.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.13"}, {"lessThan": "3.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: light: gp2ap020a00f: drain irq_work after free_irq\n\nThe threaded IRQ handler queues data->work through irq_work_queue() so\nthe trigger is polled from a per-CPU context. free_irq() does not flush\nan irq_work the handler already queued, so after gp2ap020a00f_remove()\nreturns that work may still run and call iio_trigger_poll() on data->trig,\nwhich the devm cleanup has already freed, causing a use-after-free.\n\nAdd irq_work_sync(&data->work) after free_irq() in remove() and in the\nprobe error path, mirroring commit 78601726d4a5 (\"iio: trigger: sysfs:\nfix use-after-free on remove\").\n\nFound by an in-house static analysis tool, confirmed by manual review."}], "id": "CVE-2026-98662", "lastModified": "2026-10-30T13:21:16.690", "metrics": {}, "published": "2026-10-18T16:17:19.507", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/43fbbb9eaae5d6f45668e3c4d45508c498d6ba9c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/63213927b141085b6c8719b8037dab3074b7e0fe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6f2bb000493c3b4f5715b3103657393672aea05b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/85c20d1cf3f01a506605a16c2f9ce23b9c8b114f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a1769877ff52a4f1bfb9ca535d1b5113808bd602"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a36814b9fe00970116d30c3143d81e7425c4d334"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cc71400bc965c0d3894a38ead3d71243400c2d5e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d029639b079b28a5334f934c848d895bef0653d1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via use-after-free during gp2ap020a00f device removal", "id": "2555177", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555177"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\niio: light: gp2ap020a00f: drain irq_work after free_irq\nThe threaded IRQ handler queues data->work through irq_work_queue() so\nthe trigger is polled from a per-CPU context. free_irq() does not flush\nan irq_work the handler already queued, so after gp2ap020a00f_remove()\nreturns that work may still run and call iio_trigger_poll() on data->trig,\nwhich the devm cleanup has already freed, causing a use-after-free.\nAdd irq_work_sync(&data->work) after free_irq() in remove() and in the\nprobe error path, mirroring commit 78601726d4a5 (\"iio: trigger: sysfs:\nfix use-after-free on remove\").\nFound by an in-house static analysis tool, confirmed by manual review.", "A flaw was found in the Linux kernel's gp2ap020a00f ambient light sensor driver. During device removal or initialization failure, the driver fails to properly drain scheduled interrupt tasks before releasing memory structures. A local user capable of unbinding or disconnecting the device can exploit this use-after-free flaw, leading to a system crash and Denial of Service (DoS) or potential memory corruption."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98662", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:44:24Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98662\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98662\nhttps://git.kernel.org/stable/c/63213927b141085b6c8719b8037dab3074b7e0fe\nhttps://git.kernel.org/stable/c/a1769877ff52a4f1bfb9ca535d1b5113808bd602\nhttps://git.kernel.org/stable/c/a36814b9fe00970116d30c3143d81e7425c4d334\nhttps://git.kernel.org/stable/c/cc71400bc965c0d3894a38ead3d71243400c2d5e"], "statement": "A race in the gp2ap020a00f driver allows queued irq_work to execute after the associated IIO trigger has been released during device removal. free_irq does not drain work that the threaded IRQ handler already queued, so the delayed call to iio_trigger_poll can dereference freed trigger memory. The directly supported impact is a local kernel crash and denial of service. Because this is a confirmed use after free rather than a simple NULL pointer dereference, reuse of the freed allocation may also create a potential path to confidentiality or integrity impact and privilege escalation, although no reliable write primitive is demonstrated. For the CVSS the PR:L value in the paranoid score represents deployments where a local service, container root, or restricted device management account can initiate driver removal or unbind operations. Normal direct device removal usually requires administrative privileges and is represented by PR:H in the base score. AC:H applies because successful triggering depends on winning a race between queued irq_work and device teardown. The issue is not network reachable and normally requires the affected I2C sensor driver and device to be present.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bf29fbeaa13d3350ca71df70c705d8b883c45692,a36814b9fe00970116d30c3143d81e7425c4d334)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bf29fbeaa13d3350ca71df70c705d8b883c45692,cc71400bc965c0d3894a38ead3d71243400c2d5e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bf29fbeaa13d3350ca71df70c705d8b883c45692,a1769877ff52a4f1bfb9ca535d1b5113808bd602)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bf29fbeaa13d3350ca71df70c705d8b883c45692,63213927b141085b6c8719b8037dab3074b7e0fe)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T23:00:12.909532+00:00", "updated": "2026-10-20T17:15:14.447749+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416"]}