CVE-2026-98670: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind
iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
Register the devm callback before calling devm_request_irq() so teardown frees the IRQ before cancelling zynq_unmask_work, preventing the IRQ handler from re-arming the work after the xadc structure is freed.
Event History
Frequently Asked Questions
When can the use-after-free condition occur?
It can occur during device unbind if the ZYNQ XADC alarm IRQ handler queues the delayed unmask worker after the worker cleanup has run. The queued work may then execute after the XADC structure has been freed.
What component and event are relevant when triaging exposure?
The affected path is the ZYNQ XADC alarm interrupt handling path in the Linux kernel's xilinx-xadc IIO ADC driver. Systems without use of that driver and its alarm IRQ path are not implicated by the described condition.
What change resolves the teardown race?
The fix registers the devm callback that clears the delayed work before requesting the IRQ. Because devres teardown is LIFO, this causes the IRQ to be freed before the work is cancelled, preventing the handler from queuing the work during teardown.