{"id":"CVE-2026-98721","kind":"vulnerability","aliases":["CVE-2026-98721"],"related":[],"title":"Linux kernel: Cadence NAND driver reads uninitialized IRQ state on startup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: rawnand: cadence: Initialize IRQ state before requesting IRQ\n\nThe Cadence NAND interrupt handler uses both the IRQ lock and completion\nobject. Registering the IRQ before initializing them leaves a window in\nwhich a pending interrupt can access uninitialized synchronization state.\n\nInitialize them before registering the handler.","summary":"The Cadence NAND flash driver in the Linux kernel registered its interrupt handler before setting up the lock and completion object the handler uses, so an early interrupt could touch uninitialized synchronization state. The fix initializes that state before the handler is registered.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","linux-kernel","mtd"],"not_affected_if":["no-cadence-nand-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:25+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:23+00:00","updated_at":"2026-10-25T05:17:23+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:17:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: Cadence NAND driver reads uninitialized IRQ state on startup","impact":"low","summary":"The Cadence NAND flash driver in the Linux kernel registered its interrupt handler before setting up the lock and completion object the handler uses, so an early interrupt could touch uninitialized synchronization state. The fix initializes that state before the handler is registered.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","embedded","mtd"],"confidence":0.5,"needs_auth":"no","worst_case":"unknown; a race during driver init, likely a crash or memory misuse","analyst_note":"Check the kernel.org stable commit for affected and fixed kernel versions and whether the race has a security impact beyond a crash.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-cadence-nand-hardware"],"who_is_affected":"Systems running a Linux kernel with the Cadence raw NAND driver (mtd: rawnand: cadence) present, typically embedded boards with Cadence NAND controllers. The sources do not name affected kernel versions. Systems without Cadence NAND hardware can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000566,"input_tokens":3355,"output_tokens":461,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98721':14A,17A 'access':114C 'cadenc':3A,25B,79C,87C 'complet':43B,97C 'could':52B 'cve':12A,15A 'driver':5A,28B 'earli':50B 'embed':18B 'fix':58B 'flash':27B 'follow':72C 'handler':36B,46B,64B,90C,123C 'infrastructur':19B 'initi':59B,80C,103C,118C 'interrupt':35B,51B,89C,112C 'irq':8A,81C,85C,94C,101C 'kernel':2A,22B,32B,70C 'leav':105C 'linux':1A,21B,31B,69C 'linux-kernel':20B 'lock':41B,95C 'mtd':23B,77C 'nand':4A,26B,88C 'object':44B,98C 'pend':111C 'rawnand':78C 'read':6A 'regist':33B,66B,99C,121C 'request':84C 'resolv':76C 'set':38B 'startup':11A 'state':9A,56B,61B,82C,117C 'synchron':55B,116C 'touch':53B 'uniniti':7A,54B,115C 'use':47B,91C 'vulner':73C 'window':107C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Cadence raw NAND driver (mtd: rawnand: cadence) present, typically embedded boards with Cadence NAND controllers. The sources do not name affected kernel versions. Systems without Cadence NAND hardware can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98721","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98721","severity":null,"published_at":"2026-10-18T16:17:25+00:00","modified_at":"2026-10-21T13:21:39+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}