All vulnerabilities
CVE-2026-98938

Linux: rust: irq: pass RegistrationInner as cookie to request_irq

Linux LinuxOperating systems
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in9a7931e847f338a687e96cde9f37e0cff83ddd84Fixed versionCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 9a7931e847f338a687e96cde9f37e0cff83ddd84LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

rust: irq: pass RegistrationInner as cookie to request_irq

With commit ba268514ea14 ("rust: devres: fix race condition due to nesting"), Devres::new() returns Result<Self> by value instead of initializing in-place via PinInit. Because request_irq() is called inside Devres::new(), registration.inner is still uninitialized when the IRQ is enabled, so accessing registration.inner.device() in the IRQ callback can read uninitialized memory.

Fix this by storing the Device and handler pointer in RegistrationInner and passing RegistrationInner as the IRQ cookie after its fields are initialized.

This is not needed in mainline because commit 98c63ce4d760 ("rust: irq: make Registration compatible with lifetime-bound drivers") removed Devres from irq::Registration and moved request_irq() after all fields are initialized.

Text from CVE List

Affected versions 4

  • Linuxaffected: 29e16fcd67ee5b1d0417a657294cf96fdf2f8df9 before 9a7931e847f338a687e96cde9f37e0cff83ddd84CVE List
  • Linuxaffected: 6.18CVE List
  • Linuxunaffected: all versions before 6.18CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List

References 1