CVE-2026-98496: net: airoha: npu: cancel wdt_work after releasing the WDT IRQ
In the Linux kernel, the following vulnerability has been resolved:
net: airoha: npu: cancel wdtwork after releasing the WDT IRQ
airohanpuremove() calls cancelworksync() on each core's wdtwork, but the watchdog IRQ that queues it is requested with devmrequestirq() and is freed only after .remove() returns. airohanpuwdthandler() can therefore schedulework() again once the cancel has returned. struct airohanpu, which contains the work, is devmkzalloc()'d and is freed in that same unwind, so the late work dereferences freed memory.
Register the work with devmworkautocancel() before devmrequestirq() and drop .remove(). Devres runs in reverse order, so the IRQ is freed before cancelworksync(), including when probe fails. A cancel left in .remove() cannot get that order. Initializing the work first also stops a pending watchdog interrupt from queuing an uninitialized work item. Probe currently calls INITWORK() only after devmrequestirq().
This issue was identified during our ongoing static-analysis research while reviewing kernel code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Register each core's wdt_work with devm_work_autocancel() before calling devm_request_irq(), and drop airoha_npu_remove() so the work is canceled after the watchdog IRQ is released.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel Airoha NPU driver are exposed when the driver is removed or its probe path unwinds. The affected path involves the NPU watchdog IRQ and its per-core watchdog work item.
What event is required to trigger the use-after-free?
A watchdog interrupt must occur after airoha_npu_remove() has completed cancel_work_sync() for the watchdog work but before devres frees the watchdog IRQ. The interrupt handler can then queue work that dereferences the already-freed airoha_npu structure.
Can the problem also occur during driver probe failure?
Yes. The description states that the revised resource ordering also covers probe failure, and that the original probe sequence requested the IRQ before initializing the work item. A pending watchdog interrupt could therefore queue an uninitialized work item during probe.
What mitigation is described if the fix is not yet applied?
No operational workaround is provided in the available data. The described fix requires changing resource registration order so the watchdog IRQ is released before the watchdog work is synchronously cancelled.