All vulnerabilities
CVE-2026-98662

Linux: iio: light: gp2ap020a00f: drain irq_work after free_irq

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in85c20d1cf3f01a506605a16c2f9ce23b9c8b114fAlso 63213927b141085b6c8719b8037dab3074b7e0feCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 85c20d1cf3f01a506605a16c2f9ce23b9c8b114fLinuxCVE List
  • 63213927b141085b6c8719b8037dab3074b7e0feLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: light: gp2ap020a00f: drain irq_work after free_irq

The threaded IRQ handler queues data->work through irq_work_queue() so the trigger is polled from a per-CPU context. free_irq() does not flush an irq_work the handler already queued, so after gp2ap020a00f_remove() returns that work may still run and call iio_trigger_poll() on data->trig, which the devm cleanup has already freed, causing a use-after-free.

Add irq_work_sync(&data->work) after free_irq() in remove() and in the probe error path, mirroring commit 78601726d4a5 ("iio: trigger: sysfs: fix use-after-free on remove").

Found by an in-house static analysis tool, confirmed by manual review.

Text from CVE List

Affected versions 12

  • Linuxaffected: bf29fbeaa13d3350ca71df70c705d8b883c45692 before 85c20d1cf3f01a506605a16c2f9ce23b9c8b114fCVE List
  • Linuxaffected: bf29fbeaa13d3350ca71df70c705d8b883c45692 before a36814b9fe00970116d30c3143d81e7425c4d334CVE List
  • Linuxaffected: bf29fbeaa13d3350ca71df70c705d8b883c45692 before cc71400bc965c0d3894a38ead3d71243400c2d5eCVE List
  • Linuxaffected: bf29fbeaa13d3350ca71df70c705d8b883c45692 before a1769877ff52a4f1bfb9ca535d1b5113808bd602CVE List
  • Linuxaffected: bf29fbeaa13d3350ca71df70c705d8b883c45692 before 63213927b141085b6c8719b8037dab3074b7e0feCVE List
  • Linuxaffected: 3.13CVE List
  • Linuxunaffected: all versions before 3.13CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5