CVE-2026-98740

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98740", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.367Z", "datePublished": "2026-10-18T15:47:24.602Z", "dateUpdated": "2026-10-19T09:24:50.943Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:24:50.943Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/altera: Drop __init from ECC setup paths for re-probe safety\n\nSashiko reports:\n\n\"Does suppressing sysfs unbinding fully prevent the execution of freed __init\nmemory? If altr_sysmgr_regmap_lookup_by_phandle() returns -EPROBE_DEFER, the\nprobe is deferred until after __init memory is freed.\"\n\nThe a10 EDAC .setup callbacks (sdmmc, ethernet, nand, dma, usb, qspi) and\ntheir helpers (altr_init_a10_ecc_device_type, altr_init_a10_ecc_block) were\nmarked __init. These run from the probe path, which may execute after init\nmemory is freed -- e.g. a probe deferred via -EPROBE_DEFER that only succeeds\nonce a late/module dependency appears, or a manual unbind/rebind. Calling\n__init code then dereferences freed memory. Remove __init so these functions\nremain valid at runtime."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/edac/altera_edac.c"], "versions": [{"version": "788586efd116d6d7d05985881eda503333e702b4", "lessThan": "9846b85c2eb8b749c3f14bdcc31b1070f6aabba8", "status": "affected", "versionType": "git"}, {"version": "788586efd116d6d7d05985881eda503333e702b4", "lessThan": "4ec26cb7984740941892ad21fa974963c198bfaa", "status": "affected", "versionType": "git"}, {"version": "788586efd116d6d7d05985881eda503333e702b4", "lessThan": "b62a264163ca51bee04785c581344751812395df", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/edac/altera_edac.c"], "versions": [{"version": "5.2", "status": "affected"}, {"version": "0", "lessThan": "5.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9846b85c2eb8b749c3f14bdcc31b1070f6aabba8"}, {"url": "https://git.kernel.org/stable/c/4ec26cb7984740941892ad21fa974963c198bfaa"}, {"url": "https://git.kernel.org/stable/c/b62a264163ca51bee04785c581344751812395df"}], "title": "EDAC/altera: Drop __init from ECC setup paths for re-probe safety", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/edac/altera_edac.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9846b85c2eb8b749c3f14bdcc31b1070f6aabba8", "status": "affected", "version": "788586efd116d6d7d05985881eda503333e702b4", "versionType": "git"}, {"lessThan": "4ec26cb7984740941892ad21fa974963c198bfaa", "status": "affected", "version": "788586efd116d6d7d05985881eda503333e702b4", "versionType": "git"}, {"lessThan": "b62a264163ca51bee04785c581344751812395df", "status": "affected", "version": "788586efd116d6d7d05985881eda503333e702b4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/edac/altera_edac.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.2"}, {"lessThan": "5.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/altera: Drop __init from ECC setup paths for re-probe safety\n\nSashiko reports:\n\n\"Does suppressing sysfs unbinding fully prevent the execution of freed __init\nmemory? If altr_sysmgr_regmap_lookup_by_phandle() returns -EPROBE_DEFER, the\nprobe is deferred until after __init memory is freed.\"\n\nThe a10 EDAC .setup callbacks (sdmmc, ethernet, nand, dma, usb, qspi) and\ntheir helpers (altr_init_a10_ecc_device_type, altr_init_a10_ecc_block) were\nmarked __init. These run from the probe path, which may execute after init\nmemory is freed -- e.g. a probe deferred via -EPROBE_DEFER that only succeeds\nonce a late/module dependency appears, or a manual unbind/rebind. Calling\n__init code then dereferences freed memory. Remove __init so these functions\nremain valid at runtime."}], "id": "CVE-2026-98740", "lastModified": "2026-10-19T10:19:38.170", "metrics": {}, "published": "2026-10-18T16:17:27.707", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4ec26cb7984740941892ad21fa974963c198bfaa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9846b85c2eb8b749c3f14bdcc31b1070f6aabba8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b62a264163ca51bee04785c581344751812395df"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety", "id": "2555193", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555193"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nEDAC/altera: Drop __init from ECC setup paths for re-probe safety\nSashiko reports:\n\"Does suppressing sysfs unbinding fully prevent the execution of freed __init\nmemory? If altr_sysmgr_regmap_lookup_by_phandle() returns -EPROBE_DEFER, the\nprobe is deferred until after __init memory is freed.\"\nThe a10 EDAC .setup callbacks (sdmmc, ethernet, nand, dma, usb, qspi) and\ntheir helpers (altr_init_a10_ecc_device_type, altr_init_a10_ecc_block) were\nmarked __init. These run from the probe path, which may execute after init\nmemory is freed -- e.g. a probe deferred via -EPROBE_DEFER that only succeeds\nonce a late/module dependency appears, or a manual unbind/rebind. Calling\n__init code then dereferences freed memory. Remove __init so these functions\nremain valid at runtime.", "A flaw was found in the Linux kernel's Altera Error Detection and Correction (EDAC) driver. Certain setup functions were incorrectly designated as temporary initialization routines that are released from memory after startup. When device registration is deferred or manually re-triggered, the driver attempts to execute code from this released memory. A local user with administrative access or specific boot conditions can trigger this vulnerability, leading to a Denial of Service (DoS) via a system crash or kernel memory corruption."], "name": "CVE-2026-98740", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98740\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98740\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98740.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[788586efd116d6d7d05985881eda503333e702b4,9846b85c2eb8b749c3f14bdcc31b1070f6aabba8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[788586efd116d6d7d05985881eda503333e702b4,4ec26cb7984740941892ad21fa974963c198bfaa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[788586efd116d6d7d05985881eda503333e702b4,b62a264163ca51bee04785c581344751812395df)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T20:15:14.858260+00:00", "updated": "2026-10-23T22:45:14.484770+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}