UBUNTU-CVE-2026-98656: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenablework before freeing trigger iiotriggernotifydoneatomic() defers ->reenable() into trig->reenablework on the system workqueue, and the worker dereferences the owning trigger through containerof(). Nothing cancels this work before iiotrigrelease() frees the trigger, so a worker armed by the last in-flight IRQ can outlive the free and touch freed memory. Cancel it at the top of iiotrigrelease(), which every free path reaches through the device core's final putdevice(). Found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Cancel reenable_work at the beginning of iio_trig_release() before freeing the trigger, ensuring deferred work from iio_trigger_notify_done_atomic() cannot access freed memory.