CVE-2026-98662
Received
Received - Intake
Use-After-Free in Linux Kernel IIO Light gp2ap020a00f Driver
Vulnerability report for CVE-2026-98662, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-18
Last updated on: 2026-10-18
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
iio: light: gp2ap020a00f: drain irq_work after free_irq
The threaded IRQ handler queues data->work through irq_work_queue() so
the trigger is polled from a per-CPU context. free_irq() does not flush
an irq_work the handler already queued, so after gp2ap020a00f_remove()
returns that work may still run and call iio_trigger_poll() on data->trig,
which the devm cleanup has already freed, causing a use-after-free.
Add irq_work_sync(&data->work) after free_irq() in remove() and in the
probe error path, mirroring commit 78601726d4a5 ("iio: trigger: sysfs:
fix use-after-free on remove").
Found by an in-house static analysis tool, confirmed by manual review.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | bf29fbeaa13d3350ca71df70c705d8b883c45692 |
| Linux | Linux | bf29fbeaa13d3350ca71df70c705d8b883c45692 |
| Linux | Linux | bf29fbeaa13d3350ca71df70c705d8b883c45692 |
| Linux | Linux | bf29fbeaa13d3350ca71df70c705d8b883c45692 |
| Linux | Linux | 3.13 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
