CVE-2026-98496
Received Received - Intake

Memory Corruption in Airoha NPU Linux Kernel Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdt_work after releasing the WDT IRQ airoha_npu_remove() calls cancel_work_sync() on each core's wdt_work, but the watchdog IRQ that queues it is requested with devm_request_irq() and is freed only after .remove() returns. airoha_npu_wdt_handler() can therefore schedule_work() again once the cancel has returned. struct airoha_npu, which contains the work, is devm_kzalloc()'d and is freed in that same unwind, so the late work dereferences freed memory. Register the work with devm_work_autocancel() before devm_request_irq() and drop .remove(). Devres runs in reverse order, so the IRQ is freed before cancel_work_sync(), including when probe fails. A cancel left in .remove() cannot get that order. Initializing the work first also stops a pending watchdog interrupt from queuing an uninitialized work item. Probe currently calls INIT_WORK() only after devm_request_irq(). This issue was identified during our ongoing static-analysis research while reviewing kernel code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98496
EUVD
EUVD-2026-103736

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 23290c7bc190def4e1ca61610992d9b7c32e33f3
Linux Linux 23290c7bc190def4e1ca61610992d9b7c32e33f3
Linux Linux 23290c7bc190def4e1ca61610992d9b7c32e33f3
Linux Linux 6.15

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's airoha NPU driver. It occurs when the watchdog interrupt handler tries to schedule work after the memory containing the work structure has been freed. The issue arises because the watchdog IRQ is freed after the remove function completes, but the work cancellation happens before that, allowing a race condition where freed memory is accessed.

Detection Guidance

This vulnerability is specific to the Linux kernel's airoha NPU driver and requires kernel-level inspection. Detection involves checking for the affected driver and verifying if the workqueue cancellation issue exists in the running kernel. Use commands like 'lsmod | grep airoha' to check if the module is loaded. Kernel logs may show related warnings or errors during driver removal or watchdog operations.

Impact Analysis

This vulnerability could lead to system crashes, memory corruption, or arbitrary code execution. An attacker with local access could exploit this to cause denial-of-service conditions or escalate privileges on affected systems running the vulnerable Linux kernel.

Mitigation Strategies

Apply the kernel patch that registers the work with devm_work_autocancel() before devm_request_irq() and removes the .remove() function. Update to a kernel version that includes this fix. If immediate patching is not possible, consider disabling the airoha NPU driver if not in use to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98496. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart