CVE-2026-98670: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind
The ZYNQ XADC alarm IRQ handler queues zynqunmaskwork via scheduledelayedwork(); that work is cleared by a devm callback. Register the devm callback before devmrequestirq() so the devres LIFO teardown frees the IRQ first, ensuring the handler can no longer queue work by the time the workqueue is cleared. Otherwise the handler could re-arm the work and run it after the xadc structure has been freed.
This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
During Xilinx XADC unbind teardown, free the IRQ before cancelling or clearing the zynq_unmask_work delayed work, so the alarm IRQ handler cannot re-arm or run the work after the xadc structure is freed.