CVE-2026-98656: iio: trigger: cancel reenable_work before freeing trigger
In the Linux kernel, the following vulnerability has been resolved:
iio: trigger: cancel reenablework before freeing trigger
iiotriggernotifydoneatomic() defers ->reenable() into trig->reenablework on the system workqueue, and the worker dereferences the owning trigger through containerof(). Nothing cancels this work before iiotrigrelease() frees the trigger, so a worker armed by the last in-flight IRQ can outlive the free and touch freed memory.
Cancel it at the top of iiotrigrelease(), which every free path reaches through the device core's final putdevice().
Found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Cancel trig->reenable_work at the top of iio_trig_release() before freeing the trigger.