CVE-2026-98740EDAC/altera: Drop __init from ECC setup paths for re-probe safety
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Drop __init from ECC setup paths for re-probe safety Sashiko reports: "Does suppressing sysfs unbinding fully prevent the execution of freed __init memory? If altr_sysmgr_regmap_lookup_by_phandle() returns -EPROBE_DEFER, the probe is deferred until after __init memory is freed." The a10 EDAC .setup callbacks (sdmmc, ethernet, nand, dma, usb, qspi) and their helpers (altr_init_a10_ecc_device_type, altr_init_a10_ecc_block) were marked __init. These run from the probe path, which may execute after init memory is freed -- e.g. a probe deferred via -EPROBE_DEFER that only succeeds once a late/module dependency appears, or a manual unbind/rebind. Calling __init code then dereferences freed memory. Remove __init so these functions remain valid at runtime.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | 788586efd116d6d7d05985881eda503333e702b4 builds before 9846b85c2eb8b749c3f14bdcc31b1070f6aabba8; 788586efd116d6d7d05985881eda503333e702b4 builds before 4ec26cb7984740941892ad21fa974963c198bfaa; from 788586efd116d6d7d05985881eda503333e702b4 before b62a264163ca51bee04785c581344751812395df | CNA record |
References
- https://git.kernel.org/stable/c/9846b85c2eb8b749c3f14bdcc31b1070f6aabba8
- https://git.kernel.org/stable/c/4ec26cb7984740941892ad21fa974963c198bfaa
- https://git.kernel.org/stable/c/b62a264163ca51bee04785c581344751812395df
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.