Live › vulnerability › CVE-2026-98938
Go to dashboardIn the Linux kernel's Rust IRQ code, the interrupt handler can run before its registration structure is initialized, so it may read uninitialized memory. The sources do not describe an attacker-controlled path, so the practical impact is unknown.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only kernels that include the Rust devres and IRQ registration code from the cited commit, and only systems with Rust-based IRQ drivers loaded. Systems on mainline without that change are not affected, per the commit note in the description. Stock kernels without Rust drivers can skip it.
No product ranges from the sources yet.
rust/kernel/irq in the source tree) - unknown if the sources give a specific checkEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
rust: irq: pass RegistrationInner as cookie to request_irq
With commit ba268514ea14 ("rust: devres: fix race condition due to nesting"), Devres::new() returns Result<Self> by value instead of initializing in-place via PinInit. Because request_irq() is called inside Devres::new(), registration.inner is still uninitialized when the IRQ is enabled, so accessing registration.inner.device() in the IRQ callback can read uninitialized memory.
Fix this by storing the Device and handler pointer in RegistrationInner and passing RegistrationInner as the IRQ cookie after its fields are initialized.
This is not needed in mainline because commit 98c63ce4d760 ("rust: irq: make Registration compatible with lifetime-bound drivers") removed Devres from irq::Registration and moved request_irq() after all fields are initialized.
This page as .md · .json · in your agent: get_signal("CVE-2026-98938")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.