{"id":"CVE-2026-98670","kind":"vulnerability","aliases":["CVE-2026-98670"],"related":[],"title":"Linux kernel: Xilinx XADC unbind can free memory still in use","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind\n\nThe ZYNQ XADC alarm IRQ handler queues zynq_unmask_work via\nschedule_delayed_work(); that work is cleared by a devm callback.\nRegister the devm callback before devm_request_irq() so the devres LIFO\nteardown frees the IRQ first, ensuring the handler can no longer queue\nwork by the time the workqueue is cleared. Otherwise the handler could\nre-arm the work and run it after the xadc structure has been freed.\n\nThis issue was found by an in-house static analysis tool.","summary":"On unbind, the Xilinx XADC ADC driver could cancel its unmask work after the interrupt handler could still queue it, letting the work run after the driver state was freed. The sources do not say what an attacker can gain from this use-after-free.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","linux-kernel","zynq"],"not_affected_if":["driver-not-loaded","no-xilinx-zynq-hardware"],"how_to_check":"- `unknown`","fix":"- Update the Linux kernel to a release that includes the upstream fix for the iio xilinx-xadc driver (the fix reorders the devm callback before devm_request_irq()).","status":"open","published_at":"2026-10-18T16:17:20+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:22+00:00","updated_at":"2026-10-25T05:19:22+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:19:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for the iio xilinx-xadc driver (the fix reorders the devm callback before devm_request_irq()).","reach":"local","title":"Linux kernel: Xilinx XADC unbind can free memory still in use","impact":"medium","summary":"On unbind, the Xilinx XADC ADC driver could cancel its unmask work after the interrupt handler could still queue it, letting the work run after the driver state was freed. The sources do not say what an attacker can gain from this use-after-free.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","embedded","zynq"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; a use-after-free on driver teardown in the kernel","analyst_note":"","how_to_check":"- `unknown`","needs_analyst":false,"not_affected_if":["no-xilinx-zynq-hardware","driver-not-loaded"],"who_is_affected":"Only systems that load the Xilinx XADC IIO driver (the ZYNQ alarm IRQ path) are relevant, typically Xilinx Zynq boards. Systems without that hardware or driver can skip it. The sources do not say how exposed a typical deployment is.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000585,"input_tokens":3446,"output_tokens":480,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98670':14A,17A 'adc':29B,81C 'alarm':97C 'analysi':177C 'arm':154C 'attack':61B 'callback':115C,119C 'cancel':32B,88C 'clear':111C,147C 'could':31B,40B,151C 'cve':12A,15A 'delay':106C 'devm':114C,118C,121C 'devr':126C 'driver':30B,50B 'embed':18B 'ensur':133C 'first':132C 'follow':75C 'found':170C 'free':7A,69B,85C,129C 'freed':53B,166C 'gain':63B 'handler':39B,99C,135C,150C 'hous':175C 'iio':80C 'in-hous':173C 'infrastructur':19B 'interrupt':38B 'irq':86C,98C,123C,131C 'issu':168C 'kernel':2A,22B,73C 'let':44B 'lifo':127C 'linux':1A,21B,72C 'linux-kernel':20B 'longer':138C 'memori':8A 'otherwis':148C 'queue':42B,100C,139C 're':153C 're-arm':152C 'regist':116C 'request':122C 'resolv':79C 'run':47B,158C 'say':58B 'schedul':105C 'sourc':55B 'state':51B 'static':176C 'still':9A,41B 'structur':163C 'teardown':128C 'time':143C 'tool':178C 'unbind':5A,25B,93C 'unmask':34B,90C,102C 'use':11A,67B 'use-after-fre':66B 'via':104C 'vulner':76C 'work':35B,46B,103C,107C,109C,140C,156C 'worker':91C 'workqueu':145C 'xadc':4A,28B,84C,96C,162C 'xilinx':3A,27B,83C 'xilinx-xadc':82C 'zynq':23B,95C,101C","nicknames":[],"mitigations":[],"who_affected":"Only systems that load the Xilinx XADC IIO driver (the ZYNQ alarm IRQ path) are relevant, typically Xilinx Zynq boards. Systems without that hardware or driver can skip it. The sources do not say how exposed a typical deployment is.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98670","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98670","severity":null,"published_at":"2026-10-18T16:17:20+00:00","modified_at":"2026-10-21T13:21:36+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}