CVE-2026-98740

Received Received - Intake

EDAC/altera ECC Memory Use-After-Free in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Drop __init from ECC setup paths for re-probe safety Sashiko reports: "Does suppressing sysfs unbinding fully prevent the execution of freed __init memory? If altr_sysmgr_regmap_lookup_by_phandle() returns -EPROBE_DEFER, the probe is deferred until after __init memory is freed." The a10 EDAC .setup callbacks (sdmmc, ethernet, nand, dma, usb, qspi) and their helpers (altr_init_a10_ecc_device_type, altr_init_a10_ecc_block) were marked __init. These run from the probe path, which may execute after init memory is freed -- e.g. a probe deferred via -EPROBE_DEFER that only succeeds once a late/module dependency appears, or a manual unbind/rebind. Calling __init code then dereferences freed memory. Remove __init so these functions remain valid at runtime.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98740

EUVD

EUVD-2026-103825

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	788586efd116d6d7d05985881eda503333e702b4
Linux	Linux	788586efd116d6d7d05985881eda503333e702b4
Linux	Linux	788586efd116d6d7d05985881eda503333e702b4
Linux	Linux	5.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves functions marked as __init being called after initialization memory is freed. The EDAC/altera module's ECC setup paths for devices like sdmmc, ethernet, and nand were marked __init, meaning they could be called during probe operations that happen after init memory is freed, such as deferred probes or manual unbind/rebind operations. This leads to dereferencing freed memory, causing potential crashes or instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's EDAC/altera module and involves freed __init memory. Detection requires checking kernel logs for EDAC-related errors or warnings, particularly during module probing or reprobing. Look for messages indicating deferred probe or memory access issues in sysfs or kernel logs.

Impact Analysis

This vulnerability could cause system instability or crashes if the affected EDAC/altera ECC setup functions are called after initialization memory is freed. This might happen during deferred probe scenarios or manual device re-probing, leading to kernel memory corruption or unexpected behavior in systems using the affected Linux kernel components.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a memory safety issue in the Linux kernel's EDAC/altera module, involving freed __init memory due to deferred probe paths. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for this vulnerability. The issue is resolved by removing __init from the ECC setup paths in the altr_edac driver. Check your distribution's security advisories for kernel updates addressing CVE-2026-98740.

Hi! I’m here to help you understand CVE-2026-98740. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70