{"id":"CVE-2026-98740","kind":"vulnerability","aliases":["CVE-2026-98740"],"related":[],"title":"Linux kernel: Altera EDAC ECC setup code can run from freed init memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/altera: Drop __init from ECC setup paths for re-probe safety\n\nSashiko reports:\n\n\"Does suppressing sysfs unbinding fully prevent the execution of freed __init\nmemory? If altr_sysmgr_regmap_lookup_by_phandle() returns -EPROBE_DEFER, the\nprobe is deferred until after __init memory is freed.\"\n\nThe a10 EDAC .setup callbacks (sdmmc, ethernet, nand, dma, usb, qspi) and\ntheir helpers (altr_init_a10_ecc_device_type, altr_init_a10_ecc_block) were\nmarked __init. These run from the probe path, which may execute after init\nmemory is freed -- e.g. a probe deferred via -EPROBE_DEFER that only succeeds\nonce a late/module dependency appears, or a manual unbind/rebind. Calling\n__init code then dereferences freed memory. Remove __init so these functions\nremain valid at runtime.","summary":"Some Altera EDAC ECC setup functions were marked __init, so a probe that runs after boot-time init memory is freed (for example a deferred probe or a manual rebind) can call freed code. The fix removes __init from those functions so they stay valid at runtime.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["altera-soc","embedded","linux-kernel","runtime"],"not_affected_if":["no-altera-edac-driver"],"how_to_check":"- `uname -r` to find the running kernel version\n- Check whether the Altera EDAC driver is loaded with `lsmod | grep altera_edac`\n- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit removing __init from the EDAC/altera ECC setup paths\n- unknown","status":"open","published_at":"2026-10-18T16:17:27+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:05+00:00","updated_at":"2026-10-25T05:17:05+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:17:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit removing __init from the EDAC/altera ECC setup paths\n- unknown","reach":"local","title":"Linux kernel: Altera EDAC ECC setup code can run from freed init memory","impact":"medium","summary":"Some Altera EDAC ECC setup functions were marked __init, so a probe that runs after boot-time init memory is freed (for example a deferred probe or a manual rebind) can call freed code. The fix removes __init from those functions so they stay valid at runtime.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","embedded","altera-soc"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel code may execute freed memory, possibly causing crashes or privilege escalation","analyst_note":"Check the upstream kernel commit and stable backports to find fixed kernel versions and confirm the exploitability.","how_to_check":"- `uname -r` to find the running kernel version\n- Check whether the Altera EDAC driver is loaded with `lsmod | grep altera_edac`\n- unknown","needs_analyst":true,"not_affected_if":["no-altera-edac-driver"],"who_is_affected":"Only systems running Linux kernels with the Altera EDAC driver, typically Intel/Altera SoC boards, where the driver is built in or loaded. Hosts without Altera SoC hardware or without this driver can skip it. The sources do not say which kernel versions are fixed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000637,"input_tokens":3560,"output_tokens":562,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98740':16A,19A 'a10':133C,148C,154C 'altera':3A,21B,29B 'altera-soc':20B 'altr':113C,146C,152C 'appear':188C 'block':156C 'boot':44B 'boot-tim':43B 'call':60B,193C 'callback':136C 'code':7A,62B,195C 'cve':14A,17A 'defer':53B,121C,125C,177C,180C 'depend':187C 'derefer':197C 'devic':150C 'dma':140C 'drop':87C 'e.g':174C 'ecc':5A,31B,90C,149C,155C 'edac':4A,30B,134C 'edac/altera':86C 'embed':23B 'eprob':120C,179C 'ethernet':138C 'exampl':51B 'execut':107C,168C 'fix':64B 'follow':81C 'freed':11A,49B,61B,109C,131C,173C,198C 'fulli':104C 'function':33B,69B,204C 'helper':145C 'init':12A,36B,46B,66B,88C,110C,128C,147C,153C,159C,170C,194C,201C 'kernel':2A,26B,79C 'late/module':186C 'linux':1A,25B,78C 'linux-kernel':24B 'lookup':116C 'manual':57B,191C 'mark':35B,158C 'may':167C 'memori':13A,47B,111C,129C,171C,199C 'nand':139C 'path':92C,165C 'phandl':118C 'prevent':105C 'probe':39B,54B,96C,123C,164C,176C 'qspi':142C 're':95C 're-prob':94C 'rebind':58B 'regmap':115C 'remain':205C 'remov':65B,200C 'report':99C 'resolv':85C 'return':119C 'run':9A,41B,161C 'runtim':27B,75B,208C 'safeti':97C 'sashiko':98C 'sdmmc':137C 'setup':6A,32B,91C,135C 'soc':22B 'stay':72B 'succeed':183C 'suppress':101C 'sysf':102C 'sysmgr':114C 'time':45B 'type':151C 'unbind':103C 'unbind/rebind':192C 'usb':141C 'valid':73B,206C 'via':178C 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Only systems running Linux kernels with the Altera EDAC driver, typically Intel/Altera SoC boards, where the driver is built in or loaded. Hosts without Altera SoC hardware or without this driver can skip it. The sources do not say which kernel versions are fixed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98740","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98740","severity":null,"published_at":"2026-10-18T16:17:27+00:00","modified_at":"2026-10-19T10:19:38+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}