CVE-2026-98932

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98932", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.381Z", "datePublished": "2026-10-23T12:11:35.940Z", "dateUpdated": "2026-10-24T14:09:33.367Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:09:33.367Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/altera: Fix use-after-free in error paths\n\nIn both altr_edac_a10_device_add() and altr_portb_setup(), the error path\nfreed the dci structure before releasing the devres group. Since the managed\nsingle and double bit IRQ handlers use altdev(dci->pvt_info) as their data, an\nIRQ firing between freeing dci and unregistering the IRQs could dereference\nthe freed memory.\n\nRelease the devres group first so the managed IRQs are unregistered\nbefore the dci structure is freed."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Platform-driver binding reaches altr_edac_a10_probe()->altr_edac_a10_device_add(), with the SDMMC branch continuing through socfpga_init_sdmmc_ecc()->altr_portb_setup(); no packet, media data, or remote protocol enters either patched path.\nAC:H - After the SB IRQ is registered, a DB-IRQ parse/request or edac_device_add_device() must fail, and an ECC interrupt must execute between edac_device_free_ctl_info() and devres_release_group()->free_irq(); the setup failure and hardware-fault timing are not attacker-controlled.\nPR:N - The platform core invokes altr_edac_a10_probe() automatically for the DT-described ECC manager without capable() or credential checks. The root-only altr_trigger debugfs file is created only after successful setup and cannot supply the interrupt during this failing probe.\nUI:N - Once the DT device is probed and the required setup failure and ECC interrupt occur, the unwind and stale IRQ handler execute entirely in kernel context without a victim opening a device, mounting media, or taking another action.\nS:U - The freed edac_device_ctl_info and altr_edac_device_dev objects, stale IRQ callback, and resulting corruption all reside within the same host kernel; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - edac_device_free_ctl_info() frees both dci->pvt_info and dci while altr_edac_a10_ecc_irq(), altr_edac_a10_l2_irq(), or the port-B handler can still read base, data, edac_dev, and related fields from those reclaimable objects, providing a UAF disclosure primitive.\nI:H - The stale handlers write through fields loaded from freed altdev: writel()/regmap_write() use its pointers, while edac_device_handle_ce/ue() updates counters through the freed edac_dev. Reclaiming either object therefore provides UAF write and control-flow-corruption primitives.\nA:H - Dereferencing reclaimed base, data, edac, or edac_dev pointers in the stale IRQ handler can immediately oops or panic the kernel; the L2 uncorrectable-error branch can additionally reach panic() through the freed object state."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/edac/altera_edac.c"], "versions": [{"version": "588cb03ea208b303e6dee7e916f329043fd0fc26", "lessThan": "865f3bdebbc9b34012358c377c9b15154f95f33b", "status": "affected", "versionType": "git"}, {"version": "588cb03ea208b303e6dee7e916f329043fd0fc26", "lessThan": "87364b19b3fe4e6dbf88d6acf6db4ec87e7dfbba", "status": "affected", "versionType": "git"}, {"version": "588cb03ea208b303e6dee7e916f329043fd0fc26", "lessThan": "eef3b67f9c6782127163b631c9043011a68016e2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/edac/altera_edac.c"], "versions": [{"version": "4.7", "status": "affected"}, {"version": "0", "lessThan": "4.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/865f3bdebbc9b34012358c377c9b15154f95f33b"}, {"url": "https://git.kernel.org/stable/c/87364b19b3fe4e6dbf88d6acf6db4ec87e7dfbba"}, {"url": "https://git.kernel.org/stable/c/eef3b67f9c6782127163b631c9043011a68016e2"}], "title": "EDAC/altera: Fix use-after-free in error paths", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/edac/altera_edac.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "865f3bdebbc9b34012358c377c9b15154f95f33b", "status": "affected", "version": "588cb03ea208b303e6dee7e916f329043fd0fc26", "versionType": "git"}, {"lessThan": "87364b19b3fe4e6dbf88d6acf6db4ec87e7dfbba", "status": "affected", "version": "588cb03ea208b303e6dee7e916f329043fd0fc26", "versionType": "git"}, {"lessThan": "eef3b67f9c6782127163b631c9043011a68016e2", "status": "affected", "version": "588cb03ea208b303e6dee7e916f329043fd0fc26", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/edac/altera_edac.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.7"}, {"lessThan": "4.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/altera: Fix use-after-free in error paths\n\nIn both altr_edac_a10_device_add() and altr_portb_setup(), the error path\nfreed the dci structure before releasing the devres group. Since the managed\nsingle and double bit IRQ handlers use altdev(dci->pvt_info) as their data, an\nIRQ firing between freeing dci and unregistering the IRQs could dereference\nthe freed memory.\n\nRelease the devres group first so the managed IRQs are unregistered\nbefore the dci structure is freed."}], "id": "CVE-2026-98932", "lastModified": "2026-10-24T14:16:48.647", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.4, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-23T13:17:14.013", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/865f3bdebbc9b34012358c377c9b15154f95f33b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/87364b19b3fe4e6dbf88d6acf6db4ec87e7dfbba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eef3b67f9c6782127163b631c9043011a68016e2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: EDAC/altera: Fix use-after-free in error paths", "id": "2559661", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559661"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nEDAC/altera: Fix use-after-free in error paths\nIn both altr_edac_a10_device_add() and altr_portb_setup(), the error path\nfreed the dci structure before releasing the devres group. Since the managed\nsingle and double bit IRQ handlers use altdev(dci->pvt_info) as their data, an\nIRQ firing between freeing dci and unregistering the IRQs could dereference\nthe freed memory.\nRelease the devres group first so the managed IRQs are unregistered\nbefore the dci structure is freed.", "A flaw was found in the Linux kernel's Altera EDAC (Error Detection and Correction) driver. In device setup error-handling paths, driver memory is released before the associated interrupt handlers are unregistered. If an interrupt fires during this cleanup window, the handler dereferences freed memory, resulting in a kernel crash and Denial of Service (DoS)."], "name": "CVE-2026-98932", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98932\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98932\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98932.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[588cb03ea208b303e6dee7e916f329043fd0fc26,865f3bdebbc9b34012358c377c9b15154f95f33b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[588cb03ea208b303e6dee7e916f329043fd0fc26,87364b19b3fe4e6dbf88d6acf6db4ec87e7dfbba)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[588cb03ea208b303e6dee7e916f329043fd0fc26,eef3b67f9c6782127163b631c9043011a68016e2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.7,4.7]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[588cb03ea208b303e6dee7e916f329043fd0fc26,865f3bdebbc9b34012358c377c9b15154f95f33b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[588cb03ea208b303e6dee7e916f329043fd0fc26,87364b19b3fe4e6dbf88d6acf6db4ec87e7dfbba)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[588cb03ea208b303e6dee7e916f329043fd0fc26,eef3b67f9c6782127163b631c9043011a68016e2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.7,4.7]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T15:45:16.538180+00:00", "updated": "2026-10-29T22:45:03.536914+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}