CVE-2026-98670
Description
In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind The ZYNQ XADC alarm IRQ handler queues zynq_unmask_work via schedule_delayed_work(); that work is cleared by a devm callback. Register the devm callback before devm_request_irq() so the devres LIFO teardown frees the IRQ first, ensuring the handler can no longer queue work by the time the workqueue is cleared. Otherwise the handler could re-arm the work and run it after the xadc structure has been freed. This issue was found by an in-house static analysis tool.
How to fix
- Linux Linux7958959ab2a906c04f783a3ffb979c45472ad647, 012451d72c12293918617ff98cc737bedad21910, a29d385ad7b340c952a3935af2b33488db1eb3a6, a5fe2d1b55faba6d00fd87ad491b6cb603046304, 49ea8a359e362bfbb32a647c8eb7962fbb37234e, 0f3f427076240e75ff265e61645627a71ca4918c, 5.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 2a9685d1a3b7644ca08d8355fc238b43faef7c3e ≤ v < 7958959ab2a906c04f783a3ffb979c45472ad647, 2a9685d1a3b7644ca08d8355fc238b43faef7c3e ≤ v < 012451d72c12293918617ff98cc737bedad21910, 2a9685d1a3b7644ca08d8355fc238b43faef7c3e ≤ v < a29d385ad7b340c952a3935af2b33488db1eb3a6, 2a9685d1a3b7644ca08d8355fc238b43faef7c3e ≤ v < a5fe2d1b55faba6d00fd87ad491b6cb603046304, 2a9685d1a3b7644ca08d8355fc238b43faef7c3e ≤ v < 49ea8a359e362bfbb32a647c8eb7962fbb37234e, 2a9685d1a3b7644ca08d8355fc238b43faef7c3e ≤ v < 0f3f427076240e75ff265e61645627a71ca4918c, e96eb8853f334f96312968e4f01c5a452db54c00, 5.10.200 ≤ v < 5.11, 5.12 | 7958959ab2a906c04f783a3ffb979c45472ad647, 012451d72c12293918617ff98cc737bedad21910, a29d385ad7b340c952a3935af2b33488db1eb3a6, a5fe2d1b55faba6d00fd87ad491b6cb603046304, 49ea8a359e362bfbb32a647c8eb7962fbb37234e, 0f3f427076240e75ff265e61645627a71ca4918c, 5.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.