{"id":"CVE-2026-98657","kind":"vulnerability","aliases":["CVE-2026-98657"],"related":[],"title":"Linux kernel: failed PulsedLight probe leaves a freed IIO device registered","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: proximity: pulsedlight: fix iio_device left registered on PM setup failure\n\npm_runtime_set_active() failing in probe() jumps to error_unreg_buffer,\nwhich only calls iio_triggered_buffer_cleanup() -- it does not undo the\niio_device_register() that already succeeded a few lines above. probe()\nthen returns the error, the devm-managed indio_dev is freed, but the\niio core still has it registered: the sysfs/chardev nodes stay live and\npoint at freed memory.\n\nAdd an error_unreg_dev label that unregisters the iio device before\nfalling through to the existing buffer cleanup, mirroring the teardown\norder already used in lidar_remove().","summary":"When the PulsedLight lidar driver's probe fails during power management setup, the kernel leaves the IIO device registered after its memory is freed. Local code or a user with access to the sysfs or chardev nodes could reach freed memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["iio","kernel","linux","runtime"],"not_affected_if":["no-pulsedlight-sensor"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:19+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:33+00:00","updated_at":"2026-10-25T05:19:33+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:19:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: failed PulsedLight probe leaves a freed IIO device registered","impact":"medium","summary":"When the PulsedLight lidar driver's probe fails during power management setup, the kernel leaves the IIO device registered after its memory is freed. Local code or a user with access to the sysfs or chardev nodes could reach freed memory.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","iio"],"confidence":0.5,"needs_auth":"unknown","worst_case":"use-after-free in kernel memory via stale IIO nodes","analyst_note":"Check the kernel commit that carries this fix and the stable branch versions it lands in; the NVD entry alone gives no fixed-version list.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-pulsedlight-sensor"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000527,"input_tokens":3470,"output_tokens":360,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98657':14A,17A 'access':52B 'activ':88C 'add':150C 'alreadi':113C,173C 'buffer':96C,102C,167C 'call':99C 'chardev':57B 'cleanup':103C,168C 'code':47B 'core':135C 'could':59B 'cve':12A,15A 'dev':129C,154C 'devic':10A,39B,78C,110C,160C 'devm':126C 'devm-manag':125C 'driver':26B 'error':94C,123C,152C 'exist':166C 'fail':3A,29B,89C 'failur':84C 'fall':162C 'fix':76C 'follow':68C 'freed':8A,45B,61B,131C,148C 'iio':9A,18B,38B,73C,77C,100C,109C,134C,159C 'indio':128C 'jump':92C 'kernel':2A,19B,35B,66C 'label':155C 'leav':6A,36B 'left':79C 'lidar':25B,176C 'line':117C 'linux':1A,20B,65C 'live':144C 'local':46B 'manag':32B,127C 'memori':43B,62B,149C 'mirror':169C 'node':58B,142C 'order':172C 'pm':82C,85C 'point':146C 'power':31B 'probe':5A,28B,91C,119C 'proxim':74C 'pulsedlight':4A,24B,75C 'reach':60B 'regist':11A,40B,80C,111C,139C 'remov':177C 'resolv':72C 'return':121C 'runtim':21B,86C 'set':87C 'setup':33B,83C 'stay':143C 'still':136C 'succeed':114C 'sysf':55B 'sysfs/chardev':141C 'teardown':171C 'trigger':101C 'undo':107C 'unreg':95C,153C 'unregist':157C 'use':174C 'user':50B 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98657","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98657","severity":null,"published_at":"2026-10-18T16:17:19+00:00","modified_at":"2026-10-21T13:21:34+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}