CVE-2026-98662iio: light: gp2ap020a00f: drain irq_work after free_irq
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap020a00f: drain irq_work after free_irq The threaded IRQ handler queues data->work through irq_work_queue() so the trigger is polled from a per-CPU context. free_irq() does not flush an irq_work the handler already queued, so after gp2ap020a00f_remove() returns that work may still run and call iio_trigger_poll() on data->trig, which the devm cleanup has already freed, causing a use-after-free. Add irq_work_sync(&data->work) after free_irq() in remove() and in the probe error path, mirroring commit 78601726d4a5 ("iio: trigger: sysfs: fix use-after-free on remove"). Found by an in-house static analysis tool, confirmed by manual review.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from bf29fbeaa13d3350ca71df70c705d8b883c45692 before a36814b9fe00970116d30c3143d81e7425c4d334; from bf29fbeaa13d3350ca71df70c705d8b883c45692 before cc71400bc965c0d3894a38ead3d71243400c2d5e; from bf29fbeaa13d3350ca71df70c705d8b883c45692 before a1769877ff52a4f1bfb9ca535d1b5113808bd602; from bf29fbeaa13d3350ca71df70c705d8b883c45692 before 63213927b141085b6c8719b8037dab3074b7e0fe | CNA record |
References
- https://git.kernel.org/stable/c/a36814b9fe00970116d30c3143d81e7425c4d334
- https://git.kernel.org/stable/c/cc71400bc965c0d3894a38ead3d71243400c2d5e
- https://git.kernel.org/stable/c/a1769877ff52a4f1bfb9ca535d1b5113808bd602
- https://git.kernel.org/stable/c/63213927b141085b6c8719b8037dab3074b7e0fe
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.