CVE-2026-98662

Received Received - Intake

Use-After-Free in Linux Kernel IIO Light gp2ap020a00f Driver

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap020a00f: drain irq_work after free_irq The threaded IRQ handler queues data->work through irq_work_queue() so the trigger is polled from a per-CPU context. free_irq() does not flush an irq_work the handler already queued, so after gp2ap020a00f_remove() returns that work may still run and call iio_trigger_poll() on data->trig, which the devm cleanup has already freed, causing a use-after-free. Add irq_work_sync(&data->work) after free_irq() in remove() and in the probe error path, mirroring commit 78601726d4a5 ("iio: trigger: sysfs: fix use-after-free on remove"). Found by an in-house static analysis tool, confirmed by manual review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98662

EUVD

EUVD-2026-103916

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	bf29fbeaa13d3350ca71df70c705d8b883c45692
Linux	Linux	bf29fbeaa13d3350ca71df70c705d8b883c45692
Linux	Linux	bf29fbeaa13d3350ca71df70c705d8b883c45692
Linux	Linux	bf29fbeaa13d3350ca71df70c705d8b883c45692
Linux	Linux	3.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's IIO light sensor driver (gp2ap020a00f). It occurs when the driver's remove function frees resources while a queued interrupt work item may still attempt to access them. Specifically, free_irq() does not wait for pending irq_work to complete, leading to a race condition where iio_trigger_poll() is called on a freed trigger object.

Detection Guidance

This vulnerability is specific to the Linux kernel's IIO light sensor driver (gp2ap020a00f). Detection requires checking kernel logs for use-after-free errors related to iio_trigger_poll or gp2ap020a00f. Use dmesg | grep -i "gp2ap020a00f\|iio_trigger_poll\|use-after-free" to search for related errors.

Impact Analysis

If exploited, this could cause system crashes, memory corruption, or privilege escalation. Systems using affected Linux kernel versions with the gp2ap020a00f sensor may experience instability or security breaches due to the use-after-free condition.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's IIO light sensor driver, which could lead to memory corruption or crashes. It does not directly relate to data privacy or compliance with standards like GDPR or HIPAA, as it is a low-level system integrity issue rather than a data exposure or privacy violation.

Mitigation Strategies

Apply the kernel patch that adds irq_work_sync(&data->work) after free_irq() in the remove() and probe error paths. Update to a Linux kernel version that includes this fix. Monitor kernel logs for related errors after applying the patch.

Hi! I’m here to help you understand CVE-2026-98662. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70