---
id: "CVE-2026-98670"
kind: "vulnerability"
aliases: ["CVE-2026-98670"]
title: "Linux kernel: Xilinx XADC unbind can free memory still in use"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["embedded", "infrastructure", "linux-kernel", "zynq"]
not_affected_if: ["driver-not-loaded", "no-xilinx-zynq-hardware"]
published_at: "2026-10-18T16:17:20+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:19:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98670", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: Xilinx XADC unbind can free memory still in use

On unbind, the Xilinx XADC ADC driver could cancel its unmask work after the interrupt handler could still queue it, letting the work run after the driver state was freed. The sources do not say what an attacker can gain from this use-after-free.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `unknown`

## Fix

- Update the Linux kernel to a release that includes the upstream fix for the iio xilinx-xadc driver (the fix reorders the devm callback before devm_request_irq()).

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98670

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind

The ZYNQ XADC alarm IRQ handler queues zynq_unmask_work via
schedule_delayed_work(); that work is cleared by a devm callback.
Register the devm callback before devm_request_irq() so the devres LIFO
teardown frees the IRQ first, ensuring the handler can no longer queue
work by the time the workqueue is cleared. Otherwise the handler could
re-arm the work and run it after the xadc structure has been freed.

This issue was found by an in-house static analysis tool.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_