CVE-2026-98280
Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: Disable IRQ on unbind Currently, struct xe_i2c is freed before SGUnit IRQ is disabled in unbind path, leaving a potential UAF in case I2C IRQ is hit during this small window. Explicitly disable I2C IRQ in xe_i2c_remove() and fix this. (cherry picked from commit 8ba5c8b8ab3fd362267c11df2cd5a90ee46f6e24)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-19
AI Q&A
2026-10-06
EPSS Evaluated
2026-10-18
NVD
CVE-2026-98280
EUVD
EUVD-2026-93208

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux 0bb78ce099265fba3808c05de1c75c649664a6cb
Linux Linux 0bb78ce099265fba3808c05de1c75c649664a6cb
Linux Linux 6.19

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free (UAF) issue in the drm/xe/i2c driver. When unbinding the driver, the IRQ is not disabled before freeing the struct xe_i2c, creating a small window where an interrupt could trigger a use-after-free condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM/XE I2C driver and requires kernel-level inspection. Detection involves checking for the affected driver and kernel version. Use commands like 'uname -a' to check kernel version and 'lsmod | grep xe_i2c' to verify if the vulnerable module is loaded.

Impact Analysis

This vulnerability could lead to system instability or crashes if an I2C interrupt occurs during the unbind process. It may also allow local attackers to escalate privileges or execute arbitrary code in the kernel context.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a memory management issue in the Linux kernel's DRM subsystem. No evidence suggests it impacts data protection or privacy controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. Monitor kernel security advisories and apply updates promptly. If immediate patching is not possible, consider disabling the xe_i2c module if not in use.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98280. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart