{"id":"CVE-2026-98938","kind":"vulnerability","aliases":["CVE-2026-98938"],"related":[],"title":"Linux kernel: Rust IRQ registration can read uninitialized memory in callback","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrust: irq: pass RegistrationInner as cookie to request_irq\n\nWith commit ba268514ea14 (\"rust: devres: fix race condition due to\nnesting\"), Devres::new() returns Result<Self> by value instead of\ninitializing in-place via PinInit. Because request_irq() is called\ninside Devres::new(), registration.inner is still uninitialized when the\nIRQ is enabled, so accessing registration.inner.device() in the IRQ\ncallback can read uninitialized memory.\n\nFix this by storing the Device and handler pointer in RegistrationInner\nand passing RegistrationInner as the IRQ cookie after its fields are\ninitialized.\n\nThis is not needed in mainline because commit 98c63ce4d760 (\"rust: irq:\nmake Registration compatible with lifetime-bound drivers\") removed\nDevres from irq::Registration and moved request_irq() after all fields\nare initialized.","summary":"In the Linux kernel's Rust IRQ code, the interrupt handler can run before its registration structure is initialized, so it may read uninitialized memory. The sources do not describe an attacker-controlled path, so the practical impact is unknown.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","rust-drivers","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check whether the kernel was built with Rust support and uses Rust IRQ drivers (`rust/kernel/irq` in the source tree) - unknown if the sources give a specific check","fix":"- Update to a Linux kernel release that includes the upstream fix passing RegistrationInner as the IRQ cookie (the sources do not name a version) - unknown","status":"open","published_at":"2026-10-23T13:17:14+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:05+00:00","updated_at":"2026-10-25T04:58:05+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:58:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream fix passing RegistrationInner as the IRQ cookie (the sources do not name a version) - unknown","reach":"local","title":"Linux kernel: Rust IRQ registration can read uninitialized memory in callback","impact":"low","summary":"In the Linux kernel's Rust IRQ code, the interrupt handler can run before its registration structure is initialized, so it may read uninitialized memory. The sources do not describe an attacker-controlled path, so the practical impact is unknown.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","rust-drivers","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"interrupt handler reads uninitialized kernel memory, outcome unknown","analyst_note":"Confirm which stable kernel branches carry the bug and the fixed version from the kernel.org CVE record.","how_to_check":"- Check whether the kernel was built with Rust support and uses Rust IRQ drivers (`rust/kernel/irq` in the source tree) - unknown if the sources give a specific check","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Only kernels that include the Rust devres and IRQ registration code from the cited commit, and only systems with Rust-based IRQ drivers loaded. Systems on mainline without that change are not affected, per the commit note in the description. Stock kernels without Rust drivers can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000631,"input_tokens":3538,"output_tokens":554,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98938':14A,17A '98c63ce4d760':172C 'access':131C 'attack':60B 'attacker-control':59B 'ba268514ea14':90C 'bound':181C 'call':117C 'callback':11A,136C 'code':35B 'commit':89C,171C 'compat':177C 'condit':95C 'control':61B 'cooki':84C,158C 'cve':12A,15A 'describ':57B 'devic':146C 'devr':92C,99C,119C,184C 'driver':24B,182C 'due':96C 'enabl':129C 'field':161C,194C 'fix':93C,141C 'follow':74C 'handler':38B,148C 'host':27B 'impact':66B 'in-plac':108C 'initi':46B,107C,163C,196C 'insid':118C 'instead':105C 'interrupt':37B 'irq':4A,34B,80C,87C,115C,127C,135C,157C,174C,186C,191C 'kernel':2A,20B,31B,72C 'lifetim':180C 'lifetime-bound':179C 'linux':1A,19B,30B,71C 'linux-kernel':18B 'mainlin':169C 'make':175C 'may':49B 'memori':9A,52B,140C 'move':189C 'need':167C 'nest':98C 'new':100C,120C 'pass':81C,153C 'path':62B 'pininit':112C 'place':110C 'pointer':149C 'practic':65B 'race':94C 'read':7A,50B,138C 'registr':5A,43B,176C,187C 'registration.inner':121C 'registration.inner.device':132C 'registrationinn':82C,151C,154C 'remov':183C 'request':86C,114C,190C 'resolv':78C 'result':102C 'return':101C 'run':40B 'runtim':21B 'rust':3A,23B,33B,79C,91C,173C 'rust-driv':22B 'self':26B 'self-host':25B 'sourc':54B 'still':123C 'store':144C 'structur':44B 'uniniti':8A,51B,124C,139C 'unknown':68B 'valu':104C 'via':111C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Only kernels that include the Rust devres and IRQ registration code from the cited commit, and only systems with Rust-based IRQ drivers loaded. Systems on mainline without that change are not affected, per the commit note in the description. Stock kernels without Rust drivers can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98938","severity":null,"published_at":"2026-10-23T13:17:14+00:00","modified_at":"2026-10-23T13:17:14+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}