Live › vulnerability › CVE-2026-98496
Go to dashboardIn the Airoha NPU driver, a watchdog interrupt can queue work after the driver has cancelled it during removal, so the work runs on memory that was already freed. The sources do not state what an attacker can achieve beyond a use-after-free in kernel context.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems running a Linux kernel with the Airoha NPU driver (net/airoha) loaded are exposed, which is mainly devices built on Airoha SoCs such as some routers and gateways. Hosts on other hardware, and systems that never load this driver, can skip it. Whether the trigger requires a device unbind or module removal is not stated in the sources.
No product ranges from the sources yet.
uname -r and compare against the kernel version that carries the fix, which the sources do not namelsmod | grep airoha to see whether the Airoha NPU driver is loaded at allEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: airoha: npu: cancel wdt_work after releasing the WDT IRQ
airoha_npu_remove() calls cancel_work_sync() on each core's wdt_work, but the watchdog IRQ that queues it is requested with devm_request_irq() and is freed only after .remove() returns. airoha_npu_wdt_handler() can therefore schedule_work() again once the cancel has returned. struct airoha_npu, which contains the work, is devm_kzalloc()'d and is freed in that same unwind, so the late work dereferences freed memory.
Register the work with devm_work_autocancel() before devm_request_irq() and drop .remove(). Devres runs in reverse order, so the IRQ is freed before cancel_work_sync(), including when probe fails. A cancel left in .remove() cannot get that order. Initializing the work first also stops a pending watchdog interrupt from queuing an uninitialized work item. Probe currently calls INIT_WORK() only after devm_request_irq().
This issue was identified during our ongoing static-analysis research while reviewing kernel code.
This page as .md · .json · in your agent: get_signal("CVE-2026-98496")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.