Live › vulnerability › CVE-2026-98670
Go to dashboardOn unbind, the Xilinx XADC ADC driver could cancel its unmask work after the interrupt handler could still queue it, letting the work run after the driver state was freed. The sources do not say what an attacker can gain from this use-after-free.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems that load the Xilinx XADC IIO driver (the ZYNQ alarm IRQ path) are relevant, typically Xilinx Zynq boards. Systems without that hardware or driver can skip it. The sources do not say how exposed a typical deployment is.
No product ranges from the sources yet.
unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind
The ZYNQ XADC alarm IRQ handler queues zynq_unmask_work via schedule_delayed_work(); that work is cleared by a devm callback. Register the devm callback before devm_request_irq() so the devres LIFO teardown frees the IRQ first, ensuring the handler can no longer queue work by the time the workqueue is cleared. Otherwise the handler could re-arm the work and run it after the xadc structure has been freed.
This issue was found by an in-house static analysis tool.
This page as .md · .json · in your agent: get_signal("CVE-2026-98670")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.