CVE-2026-98656
Received Received - Intake

Race Condition in Linux Kernel IIO Trigger Handling

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenable_work before freeing trigger iio_trigger_notify_done_atomic() defers ->reenable() into trig->reenable_work on the system workqueue, and the worker dereferences the owning trigger through container_of(). Nothing cancels this work before iio_trig_release() frees the trigger, so a worker armed by the last in-flight IRQ can outlive the free and touch freed memory. Cancel it at the top of iio_trig_release(), which every free path reaches through the device core's final put_device(). Found by an in-house static analysis tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98656
EUVD
EUVD-2026-103910

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 9020ef659885f2622cfb386cc229b6d618362895
Linux Linux 9020ef659885f2622cfb386cc229b6d618362895
Linux Linux 9020ef659885f2622cfb386cc229b6d618362895
Linux Linux 9020ef659885f2622cfb386cc229b6d618362895
Linux Linux a18aeac73c0f692ba40964f5f56e182312ae843b
Linux Linux 2c5c948451d57596640b20887b06b523d376eb24
Linux Linux 5.15.17
Linux Linux 5.16.3
Linux Linux 5.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the Industrial I/O (IIO) subsystem. The problem occurs when a trigger's reenable work is deferred but not canceled before the trigger is freed. A worker thread may still access the freed memory, leading to potential crashes or arbitrary code execution.

Detection Guidance

This vulnerability is specific to the Linux kernel's IIO trigger subsystem and may not have direct network detection methods. Check kernel logs for errors related to iio_trigger_notify_done_atomic or reenable_work. Commands like dmesg | grep -i iio or journalctl -k | grep -i iio may help identify issues.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause system instability, crashes, or execute arbitrary code with kernel privileges. This could lead to unauthorized access, data corruption, or denial of service on affected systems running vulnerable Linux kernel versions.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. Monitor kernel logs for any related errors after applying the update. If immediate patching is not possible, consider disabling affected IIO triggers if they are not critical to system operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98656. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart