CVE-2026-98721: mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
In the Linux kernel, the following vulnerability has been resolved:
mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
The Cadence NAND interrupt handler uses both the IRQ lock and completion object. Registering the IRQ before initializing them leaves a window in which a pending interrupt can access uninitialized synchronization state.
Initialize them before registering the handler.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In the Cadence NAND interrupt setup, initialize the IRQ lock and completion object before registering/requesting the IRQ handler, so a pending interrupt cannot access uninitialized synchronization state.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with the Cadence raw NAND driver are exposed when that driver registers its interrupt handler before initializing the IRQ lock and completion object. The provided data does not identify affected kernel versions or configurations.
What condition triggers the vulnerable window?
A pending NAND interrupt must occur after the IRQ handler is registered but before its synchronization state has been initialized. In that window, the interrupt handler can access uninitialized IRQ lock or completion state.
How can I determine whether a fix is present?
Check whether the kernel source for the Cadence raw NAND driver initializes the IRQ lock and completion object before requesting or registering the IRQ. The listed stable-kernel commit references contain the resolved change.