---
id: "CVE-2026-98938"
kind: "vulnerability"
aliases: ["CVE-2026-98938"]
title: "Linux kernel: Rust IRQ registration can read uninitialized memory in callback"
severity: "unknown"
cvss: null
epss: 0.0019
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["linux-kernel", "runtime", "rust-drivers", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-23T13:17:14+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98938", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98938", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: Rust IRQ registration can read uninitialized memory in callback

In the Linux kernel's Rust IRQ code, the interrupt handler can run before its registration structure is initialized, so it may read uninitialized memory. The sources do not describe an attacker-controlled path, so the practical impact is unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the kernel was built with Rust support and uses Rust IRQ drivers (`rust/kernel/irq` in the source tree) - unknown if the sources give a specific check

## Fix

- Update to a Linux kernel release that includes the upstream fix passing RegistrationInner as the IRQ cookie (the sources do not name a version) - unknown

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98938
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98938

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

rust: irq: pass RegistrationInner as cookie to request_irq

With commit ba268514ea14 ("rust: devres: fix race condition due to
nesting"), Devres::new() returns Result<Self> by value instead of
initializing in-place via PinInit. Because request_irq() is called
inside Devres::new(), registration.inner is still uninitialized when the
IRQ is enabled, so accessing registration.inner.device() in the IRQ
callback can read uninitialized memory.

Fix this by storing the Device and handler pointer in RegistrationInner
and passing RegistrationInner as the IRQ cookie after its fields are
initialized.

This is not needed in mainline because commit 98c63ce4d760 ("rust: irq:
make Registration compatible with lifetime-bound drivers") removed
Devres from irq::Registration and moved request_irq() after all fields
are initialized.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_