CVE-2026-98656iio: trigger: cancel reenable_work before freeing trigger
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenable_work before freeing trigger iio_trigger_notify_done_atomic() defers ->reenable() into trig->reenable_work on the system workqueue, and the worker dereferences the owning trigger through container_of(). Nothing cancels this work before iio_trig_release() frees the trigger, so a worker armed by the last in-flight IRQ can outlive the free and touch freed memory. Cancel it at the top of iio_trig_release(), which every free path reaches through the device core's final put_device(). Found by an in-house static analysis tool.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 9020ef659885f2622cfb386cc229b6d618362895 before cf513df1a2c75566cdc802d9da47f62e8d6cfd18; from 9020ef659885f2622cfb386cc229b6d618362895 before e64703280ce7a23a43c27efebeb7da457c88bf5c; 9020ef659885f2622cfb386cc229b6d618362895 builds before 882d0011c59ff8ac15188ec9ce071399ecfa10ad; 9020ef659885f2622cfb386cc229b6d618362895 builds before 2a57b9246cecd5dd797a42eb310d6c8816f26d9e; a18aeac73c0f692ba40964f5f56e182312ae843b; 2c5c948451d57596640b20887b06b523d376eb24; from 5.15.17 before 5.16; from 5.16.3 before 5.17 | CNA record |
References
- https://git.kernel.org/stable/c/cf513df1a2c75566cdc802d9da47f62e8d6cfd18
- https://git.kernel.org/stable/c/e64703280ce7a23a43c27efebeb7da457c88bf5c
- https://git.kernel.org/stable/c/882d0011c59ff8ac15188ec9ce071399ecfa10ad
- https://git.kernel.org/stable/c/2a57b9246cecd5dd797a42eb310d6c8816f26d9e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.