Live › vulnerability › CVE-2026-98656
Go to dashboardThe Linux kernel's IIO trigger subsystem can leave a deferred work item armed after the trigger is freed, so the worker later reads freed memory. The sources do not state what an attacker can gain from this use-after-free.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel without this fix that load IIO (Industrial I/O) trigger drivers for sensors and use triggered buffered capture. The sources do not say which hardware or configurations are exposed; systems without IIO triggers are unlikely to be affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
iio: trigger: cancel reenable_work before freeing trigger
iio_trigger_notify_done_atomic() defers ->reenable() into trig->reenable_work on the system workqueue, and the worker dereferences the owning trigger through container_of(). Nothing cancels this work before iio_trig_release() frees the trigger, so a worker armed by the last in-flight IRQ can outlive the free and touch freed memory.
Cancel it at the top of iio_trig_release(), which every free path reaches through the device core's final put_device().
Found by an in-house static analysis tool.
This page as .md · .json · in your agent: get_signal("CVE-2026-98656")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.