CVE-2026-98662: iio: light: gp2ap020a00f: drain irq_work after free_irq
In the Linux kernel, the following vulnerability has been resolved:
iio: light: gp2ap020a00f: drain irqwork after freeirq
The threaded IRQ handler queues data->work through irqworkqueue() so the trigger is polled from a per-CPU context. freeirq() does not flush an irqwork the handler already queued, so after gp2ap020a00fremove() returns that work may still run and call iiotriggerpoll() on data->trig, which the devm cleanup has already freed, causing a use-after-free.
Add irqworksync(&data->work) after freeirq() in remove() and in the probe error path, mirroring commit 78601726d4a5 ("iio: trigger: sysfs: fix use-after-free on remove").
Found by an in-house static analysis tool, confirmed by manual review.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add irq_work_sync(&data->work) immediately after free_irq() in both gp2ap020a00f_remove() and the probe error path, so queued irq_work is drained before cleanup frees the trigger.
Linux kernel iio: light: gp2ap020a00f driver irq_work synchronization after free_irq() = irq_work_sync(&data->work)