CVE-2026-98938

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98938", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.381Z", "datePublished": "2026-10-23T12:11:59.043Z", "dateUpdated": "2026-10-23T12:11:59.043Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-23T12:11:59.043Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust: irq: pass RegistrationInner as cookie to request_irq\n\nWith commit ba268514ea14 (\"rust: devres: fix race condition due to\nnesting\"), Devres::new() returns Result<Self> by value instead of\ninitializing in-place via PinInit. Because request_irq() is called\ninside Devres::new(), registration.inner is still uninitialized when the\nIRQ is enabled, so accessing registration.inner.device() in the IRQ\ncallback can read uninitialized memory.\n\nFix this by storing the Device and handler pointer in RegistrationInner\nand passing RegistrationInner as the IRQ cookie after its fields are\ninitialized.\n\nThis is not needed in mainline because commit 98c63ce4d760 (\"rust: irq:\nmake Registration compatible with lifetime-bound drivers\") removed\nDevres from irq::Registration and moved request_irq() after all fields\nare initialized."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["rust/kernel/irq/request.rs"], "versions": [{"version": "29e16fcd67ee5b1d0417a657294cf96fdf2f8df9", "lessThan": "9a7931e847f338a687e96cde9f37e0cff83ddd84", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["rust/kernel/irq/request.rs"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9a7931e847f338a687e96cde9f37e0cff83ddd84"}], "title": "rust: irq: pass RegistrationInner as cookie to request_irq", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["rust/kernel/irq/request.rs"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9a7931e847f338a687e96cde9f37e0cff83ddd84", "status": "affected", "version": "29e16fcd67ee5b1d0417a657294cf96fdf2f8df9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["rust/kernel/irq/request.rs"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust: irq: pass RegistrationInner as cookie to request_irq\n\nWith commit ba268514ea14 (\"rust: devres: fix race condition due to\nnesting\"), Devres::new() returns Result<Self> by value instead of\ninitializing in-place via PinInit. Because request_irq() is called\ninside Devres::new(), registration.inner is still uninitialized when the\nIRQ is enabled, so accessing registration.inner.device() in the IRQ\ncallback can read uninitialized memory.\n\nFix this by storing the Device and handler pointer in RegistrationInner\nand passing RegistrationInner as the IRQ cookie after its fields are\ninitialized.\n\nThis is not needed in mainline because commit 98c63ce4d760 (\"rust: irq:\nmake Registration compatible with lifetime-bound drivers\") removed\nDevres from irq::Registration and moved request_irq() after all fields\nare initialized."}], "id": "CVE-2026-98938", "lastModified": "2026-10-23T13:17:14.720", "metrics": {}, "published": "2026-10-23T13:17:14.720", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9a7931e847f338a687e96cde9f37e0cff83ddd84"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via uninitialized memory read in Rust IRQ registration", "id": "2559672", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559672"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-908", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nrust: irq: pass RegistrationInner as cookie to request_irq\nWith commit ba268514ea14 (\"rust: devres: fix race condition due to\nnesting\"), Devres::new() returns Result<Self> by value instead of\ninitializing in-place via PinInit. Because request_irq() is called\ninside Devres::new(), registration.inner is still uninitialized when the\nIRQ is enabled, so accessing registration.inner.device() in the IRQ\ncallback can read uninitialized memory.\nFix this by storing the Device and handler pointer in RegistrationInner\nand passing RegistrationInner as the IRQ cookie after its fields are\ninitialized.\nThis is not needed in mainline because commit 98c63ce4d760 (\"rust: irq:\nmake Registration compatible with lifetime-bound drivers\") removed\nDevres from irq::Registration and moved request_irq() after all fields\nare initialized.", "A flaw was found in the Linux kernel's Rust interrupt handling subsystem. During interrupt request (IRQ) registration, an interrupt can be serviced before the registration structure is fully initialized, causing the callback handler to access uninitialized memory. A local attacker could exploit this flaw to cause a Denial of Service (DoS) through a kernel crash or potentially expose sensitive kernel information."], "name": "CVE-2026-98938", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T12:11:59Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98938\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98938\nhttps://git.kernel.org/stable/c/9a7931e847f338a687e96cde9f37e0cff83ddd84"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[29e16fcd67ee5b1d0417a657294cf96fdf2f8df9,9a7931e847f338a687e96cde9f37e0cff83ddd84)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[29e16fcd67ee5b1d0417a657294cf96fdf2f8df9,9a7931e847f338a687e96cde9f37e0cff83ddd84)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T17:00:14.302244+00:00", "updated": "2026-10-29T22:15:04.253747+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}