CVE-2026-98496: net: airoha: npu: cancel wdt_work after releasing the WDT IRQ
In the Linux kernel, the following vulnerability has been resolved:
net: airoha: npu: cancel wdtwork after releasing the WDT IRQ
airohanpuremove() calls cancelworksync() on each core's wdtwork, but the watchdog IRQ that queues it is requested with devmrequestirq() and is freed only after .remove() returns. airohanpuwdthandler() can therefore schedulework() again once the cancel has returned. struct airohanpu, which contains the work, is devmkzalloc()'d and is freed in that same unwind, so the late work dereferences freed memory.
Register the work with devmworkautocancel() before devmrequestirq() and drop .remove(). Devres runs in reverse order, so the IRQ is freed before cancelworksync(), including when probe fails. A cancel left in .remove() cannot get that order. Initializing the work first also stops a pending watchdog interrupt from queuing an uninitialized work item. Probe currently calls INITWORK() only after devmrequestirq().
This issue was identified during our ongoing static-analysis research while reviewing kernel code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Register each watchdog work item with devm_work_autocancel() before calling devm_request_irq(), so devres unwinds in reverse order and releases the watchdog IRQ before cancelling the work; retain cancellation before freeing the airoha_npu object.