CVE-2026-98435: EDAC/altera: Use parent device for devres in altr_portb_setup()
EDAC/altera: Use parent device for devres in altrportbsetup()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In altr_portb_setup(), anchor devres_open_group(), devm_request_irq(), devres_remove_group(), and devres_release_group() to the actual parent device (device->edac->dev) rather than the embedded struct device in the copied per-port altr_edac_device_dev.
Event History
Frequently Asked Questions
What component and condition are involved?
The issue is in the Linux kernel EDAC Altera code path, specifically altr_portb_setup(). It concerns devres groups and devm-managed IRQ requests being associated with an embedded copied device rather than the long-lived parent EDAC device.
What is the practical impact of the fix?
The fix makes the devres group and IRQ resources use the same parent device, so they are removed and released together. This prevents mismatched resource ownership and teardown in that setup path.
How can I determine whether a kernel includes the fix?
Check whether the kernel source or applied stable patches includes one of the referenced commits: 8325ecf3f16d764a0e0ba42c95b63f08e38710a8, 2cf03ada03532bfb42f06fbf01d9e2a99e6011d7, or dc4797c909b6cacb1bb24449e6c57d50a14d73bf.