CVE-2026-97600
Received Received - Intake

Use-After-Free in Linux Kernel ieee802154 cc2520 Driver

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ieee802154: cc2520: fix FIFOP work use-after-free The FIFOP interrupt handler queues cc2520_fifop_irqwork. On removal, cc2520_remove() only flushes the work. The devm-managed FIFOP IRQ remains active until after ->remove() returns and can queue the work again after that flush, allowing it to run after the private data is released. Disable the work with disable_work_sync() instead of flushing it, so the handler can no longer queue it once removal begins. Destroy the buffer mutex last, since the worker and the stop callback invoked through ieee802154_unregister_hw() both take it. Found by an in-house static analysis tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97600
EUVD
EUVD-2026-86731

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free flaw in the Linux kernel's ieee802154 subsystem, specifically affecting the cc2520 driver. It occurs when the FIFOP interrupt handler queues work that runs after the driver's private data is released. The issue arises because the driver's removal function only flushes the workqueue but does not prevent new work from being queued by an active IRQ.

Detection Guidance

This vulnerability is specific to the Linux kernel's ieee802154 subsystem and the cc2520 driver. Detection requires kernel-level inspection rather than network commands. Check kernel logs for FIFOP interrupt-related errors or crashes during device removal. Look for use-after-free warnings in dmesg or system logs.

Impact Analysis

This vulnerability could lead to system crashes or memory corruption if exploited. It may allow an attacker with local access to trigger a use-after-free condition, potentially escalating privileges or causing denial-of-service. Systems using the affected cc2520 driver are at risk.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for CVE-2026-97600. If using a custom kernel, apply the patch that replaces flush_work() with disable_work_sync() in the cc2520 driver. Monitor kernel updates from your distribution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart