{"id":"CVE-2026-98662","kind":"vulnerability","aliases":["CVE-2026-98662"],"related":[],"title":"Linux kernel: light sensor driver use-after-free on device removal","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: light: gp2ap020a00f: drain irq_work after free_irq\n\nThe threaded IRQ handler queues data->work through irq_work_queue() so\nthe trigger is polled from a per-CPU context.  free_irq() does not flush\nan irq_work the handler already queued, so after gp2ap020a00f_remove()\nreturns that work may still run and call iio_trigger_poll() on data->trig,\nwhich the devm cleanup has already freed, causing a use-after-free.\n\nAdd irq_work_sync(&data->work) after free_irq() in remove() and in the\nprobe error path, mirroring commit 78601726d4a5 (\"iio: trigger: sysfs:\nfix use-after-free on remove\").\n\nFound by an in-house static analysis tool, confirmed by manual review.","summary":"The gp2ap020a00f IIO light sensor driver can run queued interrupt work after its device is removed, touching freed trigger memory. The sources do not say what an attacker gets beyond a use-after-free in the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["iio-drivers","infrastructure","linux-kernel"],"not_affected_if":["no-gp2ap020a00f-sensor"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:19+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:29+00:00","updated_at":"2026-10-25T05:19:29+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:19:29Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel: light sensor driver use-after-free on device removal","impact":"medium","summary":"The gp2ap020a00f IIO light sensor driver can run queued interrupt work after its device is removed, touching freed trigger memory. The sources do not say what an attacker gets beyond a use-after-free in the kernel.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","iio-drivers"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory use-after-free during driver removal; code execution not stated.","analyst_note":"Find the fixed kernel stable versions and the CVSS score from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98662 and the linked upstream commit 78601726d4a5 reference.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-gp2ap020a00f-sensor"],"who_is_affected":"Only systems loading the gp2ap020a00f IIO light sensor driver are in scope, which means Linux machines with that sensor hardware bound to the driver. unknown whether the sources list affected kernel versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000584,"input_tokens":3496,"output_tokens":468,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98662':15A,18A '78601726d4a5':167C 'add':148C 'alreadi':115C,140C 'analysi':185C 'attack':53B 'beyond':55B 'call':128C 'caus':142C 'cleanup':138C 'commit':166C 'confirm':187C 'context':104C 'cpu':103C 'cve':13A,16A 'data':88C,133C,152C 'devic':11A,39B 'devm':137C 'drain':77C 'driver':5A,21B,31B 'error':163C 'fix':171C 'flush':109C 'follow':69C 'found':178C 'free':9A,60B,81C,105C,147C,155C,175C 'freed':43B,141C 'get':54B 'gp2ap020a00f':27B,76C,119C 'handler':86C,114C 'hous':183C 'iio':20B,28B,74C,129C,168C 'iio-driv':19B 'in-hous':181C 'infrastructur':22B 'interrupt':35B 'irq':78C,82C,85C,91C,106C,111C,149C,156C 'kernel':2A,25B,63B,67C 'light':3A,29B,75C 'linux':1A,24B,66C 'linux-kernel':23B 'manual':189C 'may':124C 'memori':45B 'mirror':165C 'path':164C 'per':102C 'per-cpu':101C 'poll':98C,131C 'probe':162C 'queu':34B,116C 'queue':87C,93C 'remov':12A,41B,120C,158C,177C 'resolv':73C 'return':121C 'review':190C 'run':33B,126C 'say':50B 'sensor':4A,30B 'sourc':47B 'static':184C 'still':125C 'sync':151C 'sysf':170C 'thread':84C 'tool':186C 'touch':42B 'trig':134C 'trigger':44B,96C,130C,169C 'use':7A,58B,145C,173C 'use-after-fre':6A,57B,144C,172C 'vulner':70C 'work':36B,79C,89C,92C,112C,123C,150C,153C","nicknames":[],"mitigations":[],"who_affected":"Only systems loading the gp2ap020a00f IIO light sensor driver are in scope, which means Linux machines with that sensor hardware bound to the driver. unknown whether the sources list affected kernel versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98662","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98662","severity":null,"published_at":"2026-10-18T16:17:19+00:00","modified_at":"2026-10-21T13:21:35+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}