CVE-2026-98496net: airoha: npu: cancel wdt_work after releasing the WDT IRQ
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdt_work after releasing the WDT IRQ airoha_npu_remove() calls cancel_work_sync() on each core's wdt_work, but the watchdog IRQ that queues it is requested with devm_request_irq() and is freed only after .remove() returns. airoha_npu_wdt_handler() can therefore schedule_work() again once the cancel has returned. struct airoha_npu, which contains the work, is devm_kzalloc()'d and is freed in that same unwind, so the late work dereferences freed memory. Register the work with devm_work_autocancel() before devm_request_irq() and drop .remove(). Devres runs in reverse order, so the IRQ is freed before cancel_work_sync(), including when probe fails. A cancel left in .remove() cannot get that order. Initializing the work first also stops a pending watchdog interrupt from queuing an uninitialized work item. Probe currently calls INIT_WORK() only after devm_request_irq(). This issue was identified during our ongoing static-analysis research while reviewing kernel code.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 23290c7bc190def4e1ca61610992d9b7c32e33f3 before aca91d8fa0ecbc990ebf9a688c684dda78a43c00; from 23290c7bc190def4e1ca61610992d9b7c32e33f3 before da9d42531f3a6dfea2e9c775b62a46185dbf280a; 23290c7bc190def4e1ca61610992d9b7c32e33f3 builds before 4bdee8060d1e4581624e68fbd369b1afb14df4bc | CNA record |
References
- https://git.kernel.org/stable/c/aca91d8fa0ecbc990ebf9a688c684dda78a43c00
- https://git.kernel.org/stable/c/da9d42531f3a6dfea2e9c775b62a46185dbf280a
- https://git.kernel.org/stable/c/4bdee8060d1e4581624e68fbd369b1afb14df4bc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.