{"id":"CVE-2026-98496","kind":"vulnerability","aliases":["CVE-2026-98496"],"related":[],"title":"Linux kernel: Airoha NPU driver can run freed memory on removal","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: npu: cancel wdt_work after releasing the WDT IRQ\n\nairoha_npu_remove() calls cancel_work_sync() on each core's wdt_work,\nbut the watchdog IRQ that queues it is requested with devm_request_irq()\nand is freed only after .remove() returns.  airoha_npu_wdt_handler() can\ntherefore schedule_work() again once the cancel has returned.  struct\nairoha_npu, which contains the work, is devm_kzalloc()'d and is freed in\nthat same unwind, so the late work dereferences freed memory.\n\nRegister the work with devm_work_autocancel() before devm_request_irq()\nand drop .remove().  Devres runs in reverse order, so the IRQ is freed\nbefore cancel_work_sync(), including when probe fails.  A cancel left in\n.remove() cannot get that order.  Initializing the work first also stops\na pending watchdog interrupt from queuing an uninitialized work item.\nProbe currently calls INIT_WORK() only after devm_request_irq().\n\nThis issue was identified during our ongoing static-analysis research\nwhile reviewing kernel code.","summary":"In the Airoha NPU driver, a watchdog interrupt can queue work after the driver has cancelled it during removal, so the work runs on memory that was already freed. The sources do not state what an attacker can achieve beyond a use-after-free in kernel context.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["airoha-soc","embedded","linux-kernel","routers","runtime"],"not_affected_if":["driver-not-loaded","no-airoha-hardware"],"how_to_check":"- `uname -r` and compare against the kernel version that carries the fix, which the sources do not name\n- `lsmod | grep airoha` to see whether the Airoha NPU driver is loaded at all\n- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit for this fix (version unknown from the sources)\n- unknown","status":"open","published_at":"2026-10-18T16:17:00+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:38+00:00","updated_at":"2026-10-25T05:25:38+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:25:38Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit for this fix (version unknown from the sources)\n- unknown","reach":"local","title":"Linux kernel: Airoha NPU driver can run freed memory on removal","impact":"medium","summary":"In the Airoha NPU driver, a watchdog interrupt can queue work after the driver has cancelled it during removal, so the work runs on memory that was already freed. The sources do not state what an attacker can achieve beyond a use-after-free in kernel context.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","airoha-soc","embedded","routers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"kernel memory use-after-free during driver removal; code execution not confirmed","analyst_note":"Check the NVD entry and the upstream kernel commit for the fixed kernel versions and the exact trigger conditions.","how_to_check":"- `uname -r` and compare against the kernel version that carries the fix, which the sources do not name\n- `lsmod | grep airoha` to see whether the Airoha NPU driver is loaded at all\n- unknown","needs_analyst":true,"not_affected_if":["no-airoha-hardware","driver-not-loaded"],"who_is_affected":"Only systems running a Linux kernel with the Airoha NPU driver (net/airoha) loaded are exposed, which is mainly devices built on Airoha SoCs such as some routers and gateways. Hosts on other hardware, and systems that never load this driver, can skip it. Whether the trigger requires a device unbind or module removal is not stated in the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000662,"input_tokens":3612,"output_tokens":602,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98496':14A,17A 'achiev':65B 'airoha':3A,19B,29B,86C,96C,129C,144C 'airoha-soc':18B 'alreadi':54B 'also':213C 'analysi':244C 'attack':63B 'autocancel':174C 'beyond':66B 'call':99C,227C 'cancel':42B,88C,100C,140C,193C,201C 'cannot':205C 'code':249C 'contain':147C 'context':74B 'core':105C 'current':226C 'cve':12A,15A 'd':153C 'derefer':165C 'devm':119C,151C,172C,176C,232C 'devr':182C 'driver':5A,31B,40B 'drop':180C 'embed':21B 'fail':199C 'first':212C 'follow':80C 'free':71B 'freed':8A,55B,124C,156C,166C,191C 'get':206C 'handler':132C 'identifi':238C 'includ':196C 'init':228C 'initi':209C 'interrupt':34B,218C 'irq':95C,112C,121C,178C,189C,234C 'issu':236C 'item':224C 'kernel':2A,24B,73B,78C,248C 'kzalloc':152C 'late':163C 'left':202C 'linux':1A,23B,77C 'linux-kernel':22B 'memori':9A,51B,167C 'net':85C 'npu':4A,30B,87C,97C,130C,145C 'ongo':241C 'order':186C,208C 'pend':216C 'probe':198C,225C 'queu':220C 'queue':36B,114C 'regist':168C 'releas':92C 'remov':11A,45B,98C,127C,181C,204C 'request':117C,120C,177C,233C 'research':245C 'resolv':84C 'return':128C,142C 'revers':185C 'review':247C 'router':25B 'run':7A,49B,183C 'runtim':26B 'schedul':135C 'soc':20B 'sourc':57B 'state':60B 'static':243C 'static-analysi':242C 'stop':214C 'struct':143C 'sync':102C,195C 'therefor':134C 'uniniti':222C 'unwind':160C 'use':69B 'use-after-fre':68B 'vulner':81C 'watchdog':33B,111C,217C 'wdt':89C,94C,107C,131C 'work':37B,48B,90C,101C,108C,136C,149C,164C,170C,173C,194C,211C,223C,229C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a Linux kernel with the Airoha NPU driver (net/airoha) loaded are exposed, which is mainly devices built on Airoha SoCs such as some routers and gateways. Hosts on other hardware, and systems that never load this driver, can skip it. Whether the trigger requires a device unbind or module removal is not stated in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98496","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98496","severity":null,"published_at":"2026-10-18T16:17:00+00:00","modified_at":"2026-10-19T10:19:02+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}