CVE-2026-98656: iio: trigger: cancel reenable_work before freeing trigger
iio: trigger: cancel reenablework before freeing trigger
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1 - Compensating control
Cancel trig->reenable_work at the top of iio_trig_release(), before freeing the trigger, so deferred work cannot outlive the trigger.
Event History
Frequently Asked Questions
What condition is required for the use-after-free to occur?
A trigger's reenable work must be queued by iio_trigger_notify_done_atomic() while the trigger is being released. If that queued worker runs after iio_trig_release() frees the trigger, it can dereference freed memory.
Which trigger removal paths need mitigation?
The described fix belongs in iio_trig_release(), because every trigger free path reaches that function through the device core's final put_device(). Mitigations should ensure pending reenable_work is cancelled before the trigger is freed.
How can I determine whether the fix is present?
Check whether iio_trig_release() cancels the trigger's reenable_work before freeing the trigger. The provided stable-kernel references identify commits containing the resolution.