CVE-2026-98670

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98670", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.363Z", "datePublished": "2026-10-18T15:45:14.810Z", "dateUpdated": "2026-10-30T12:38:37.715Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:38:37.715Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind\n\nThe ZYNQ XADC alarm IRQ handler queues zynq_unmask_work via\nschedule_delayed_work(); that work is cleared by a devm callback.\nRegister the devm callback before devm_request_irq() so the devres LIFO\nteardown frees the IRQ first, ensuring the handler can no longer queue\nwork by the time the workqueue is cleared. Otherwise the handler could\nre-arm the work and run it after the xadc structure has been freed.\n\nThis issue was found by an in-house static analysis tool."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iio/adc/xilinx-xadc-core.c"], "versions": [{"version": "2a9685d1a3b7644ca08d8355fc238b43faef7c3e", "lessThan": "7958959ab2a906c04f783a3ffb979c45472ad647", "status": "affected", "versionType": "git"}, {"version": "2a9685d1a3b7644ca08d8355fc238b43faef7c3e", "lessThan": "012451d72c12293918617ff98cc737bedad21910", "status": "affected", "versionType": "git"}, {"version": "2a9685d1a3b7644ca08d8355fc238b43faef7c3e", "lessThan": "a29d385ad7b340c952a3935af2b33488db1eb3a6", "status": "affected", "versionType": "git"}, {"version": "2a9685d1a3b7644ca08d8355fc238b43faef7c3e", "lessThan": "a5fe2d1b55faba6d00fd87ad491b6cb603046304", "status": "affected", "versionType": "git"}, {"version": "2a9685d1a3b7644ca08d8355fc238b43faef7c3e", "lessThan": "49ea8a359e362bfbb32a647c8eb7962fbb37234e", "status": "affected", "versionType": "git"}, {"version": "2a9685d1a3b7644ca08d8355fc238b43faef7c3e", "lessThan": "0f3f427076240e75ff265e61645627a71ca4918c", "status": "affected", "versionType": "git"}, {"version": "e96eb8853f334f96312968e4f01c5a452db54c00", "status": "affected", "versionType": "git"}, {"version": "5.10.200", "lessThan": "5.11", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iio/adc/xilinx-xadc-core.c"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.200"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7958959ab2a906c04f783a3ffb979c45472ad647"}, {"url": "https://git.kernel.org/stable/c/012451d72c12293918617ff98cc737bedad21910"}, {"url": "https://git.kernel.org/stable/c/a29d385ad7b340c952a3935af2b33488db1eb3a6"}, {"url": "https://git.kernel.org/stable/c/a5fe2d1b55faba6d00fd87ad491b6cb603046304"}, {"url": "https://git.kernel.org/stable/c/49ea8a359e362bfbb32a647c8eb7962fbb37234e"}, {"url": "https://git.kernel.org/stable/c/0f3f427076240e75ff265e61645627a71ca4918c"}], "title": "iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/iio/adc/xilinx-xadc-core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7958959ab2a906c04f783a3ffb979c45472ad647", "status": "affected", "version": "2a9685d1a3b7644ca08d8355fc238b43faef7c3e", "versionType": "git"}, {"lessThan": "012451d72c12293918617ff98cc737bedad21910", "status": "affected", "version": "2a9685d1a3b7644ca08d8355fc238b43faef7c3e", "versionType": "git"}, {"lessThan": "a29d385ad7b340c952a3935af2b33488db1eb3a6", "status": "affected", "version": "2a9685d1a3b7644ca08d8355fc238b43faef7c3e", "versionType": "git"}, {"lessThan": "a5fe2d1b55faba6d00fd87ad491b6cb603046304", "status": "affected", "version": "2a9685d1a3b7644ca08d8355fc238b43faef7c3e", "versionType": "git"}, {"lessThan": "49ea8a359e362bfbb32a647c8eb7962fbb37234e", "status": "affected", "version": "2a9685d1a3b7644ca08d8355fc238b43faef7c3e", "versionType": "git"}, {"lessThan": "0f3f427076240e75ff265e61645627a71ca4918c", "status": "affected", "version": "2a9685d1a3b7644ca08d8355fc238b43faef7c3e", "versionType": "git"}, {"status": "affected", "version": "e96eb8853f334f96312968e4f01c5a452db54c00", "versionType": "git"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.200", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/iio/adc/xilinx-xadc-core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind\n\nThe ZYNQ XADC alarm IRQ handler queues zynq_unmask_work via\nschedule_delayed_work(); that work is cleared by a devm callback.\nRegister the devm callback before devm_request_irq() so the devres LIFO\nteardown frees the IRQ first, ensuring the handler can no longer queue\nwork by the time the workqueue is cleared. Otherwise the handler could\nre-arm the work and run it after the xadc structure has been freed.\n\nThis issue was found by an in-house static analysis tool."}], "id": "CVE-2026-98670", "lastModified": "2026-10-30T13:21:17.407", "metrics": {}, "published": "2026-10-18T16:17:20.300", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/012451d72c12293918617ff98cc737bedad21910"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f3f427076240e75ff265e61645627a71ca4918c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/49ea8a359e362bfbb32a647c8eb7962fbb37234e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7958959ab2a906c04f783a3ffb979c45472ad647"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a29d385ad7b340c952a3935af2b33488db1eb3a6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a5fe2d1b55faba6d00fd87ad491b6cb603046304"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind", "id": "2555131", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555131"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\niio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind\nThe ZYNQ XADC alarm IRQ handler queues zynq_unmask_work via\nschedule_delayed_work(); that work is cleared by a devm callback.\nRegister the devm callback before devm_request_irq() so the devres LIFO\nteardown frees the IRQ first, ensuring the handler can no longer queue\nwork by the time the workqueue is cleared. Otherwise the handler could\nre-arm the work and run it after the xadc structure has been freed.\nThis issue was found by an in-house static analysis tool.", "A flaw was found in the Linux kernel's Xilinx XADC driver. During device unbinding, an improper cleanup order allows interrupt requests (IRQs) to remain active after delayed work has been cancelled. A local user capable of detaching the device can cause an interrupt to schedule work that executes after device memory has been freed, leading to a use-after-free condition. This flaw primarily results in a Denial of Service (DoS) via a kernel crash, or potentially enables arbitrary code execution."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98670", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98670\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98670\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98670.mbox"], "statement": "An incorrect devres teardown order in the Xilinx Zynq XADC driver can allow the alarm IRQ handler to queue zynq_unmask_work after the delayed work was already cancelled. The queued worker may then run after the containing xadc structure has been freed, creating a use-after-free condition. The most direct impact is a kernel crash and local denial of service. Reuse of the freed work item memory may also create a potential path to kernel memory corruption or privilege escalation, although a reliable controlled write primitive is not established by the available code. For the CVSS the PR:H reflects that driver unbind or device removal normally requires administrative control on the host. AC:H reflects the narrow race window between work cancellation and IRQ release. The issue is not network reachable and requires affected Xilinx Zynq XADC hardware with the relevant interrupt path active.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a9685d1a3b7644ca08d8355fc238b43faef7c3e,a29d385ad7b340c952a3935af2b33488db1eb3a6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a9685d1a3b7644ca08d8355fc238b43faef7c3e,a5fe2d1b55faba6d00fd87ad491b6cb603046304)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a9685d1a3b7644ca08d8355fc238b43faef7c3e,49ea8a359e362bfbb32a647c8eb7962fbb37234e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a9685d1a3b7644ca08d8355fc238b43faef7c3e,0f3f427076240e75ff265e61645627a71ca4918c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "e96eb8853f334f96312968e4f01c5a452db54c00"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.10.200,5.11)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,8.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc6,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T19:00:11.977297+00:00", "updated": "2026-10-22T21:00:08.771333+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}