All vulnerabilities
CVE-2026-98670

Linux: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in012451d72c12293918617ff98cc737bedad21910Also 49ea8a359e362bfbb32a647c8eb7962fbb37234e, 0f3f427076240e75ff265e61645627a71ca4918c and 1 moreCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 012451d72c12293918617ff98cc737bedad21910LinuxCVE List
  • 49ea8a359e362bfbb32a647c8eb7962fbb37234eLinuxCVE List
  • 0f3f427076240e75ff265e61645627a71ca4918cLinuxCVE List
  • 5.11LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind

The ZYNQ XADC alarm IRQ handler queues zynq_unmask_work via schedule_delayed_work(); that work is cleared by a devm callback. Register the devm callback before devm_request_irq() so the devres LIFO teardown frees the IRQ first, ensuring the handler can no longer queue work by the time the workqueue is cleared. Otherwise the handler could re-arm the work and run it after the xadc structure has been freed.

This issue was found by an in-house static analysis tool.

Text from CVE List

Affected versions 14

  • Linuxaffected: 2a9685d1a3b7644ca08d8355fc238b43faef7c3e before 012451d72c12293918617ff98cc737bedad21910CVE List
  • Linuxaffected: 2a9685d1a3b7644ca08d8355fc238b43faef7c3e before a29d385ad7b340c952a3935af2b33488db1eb3a6CVE List
  • Linuxaffected: 2a9685d1a3b7644ca08d8355fc238b43faef7c3e before a5fe2d1b55faba6d00fd87ad491b6cb603046304CVE List
  • Linuxaffected: 2a9685d1a3b7644ca08d8355fc238b43faef7c3e before 49ea8a359e362bfbb32a647c8eb7962fbb37234eCVE List
  • Linuxaffected: 2a9685d1a3b7644ca08d8355fc238b43faef7c3e before 0f3f427076240e75ff265e61645627a71ca4918cCVE List
  • Linuxaffected: e96eb8853f334f96312968e4f01c5a452db54c00CVE List
  • Linuxaffected: 5.10.200 before 5.11CVE List
  • Linuxaffected: 5.12CVE List
  • Linuxunaffected: all versions before 5.12CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5