{"id":"CVE-2026-98670","summary":"iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind","details":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind\n\nThe ZYNQ XADC alarm IRQ handler queues zynq_unmask_work via\nschedule_delayed_work(); that work is cleared by a devm callback.\nRegister the devm callback before devm_request_irq() so the devres LIFO\nteardown frees the IRQ first, ensuring the handler can no longer queue\nwork by the time the workqueue is cleared. Otherwise the handler could\nre-arm the work and run it after the xadc structure has been freed.\n\nThis issue was found by an in-house static analysis tool.","modified":"2026-10-19T02:46:01.195641177Z","published":"2026-10-18T15:45:14.810Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98670.json","cna_assigner":"Linux"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/0f3f427076240e75ff265e61645627a71ca4918c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/49ea8a359e362bfbb32a647c8eb7962fbb37234e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a29d385ad7b340c952a3935af2b33488db1eb3a6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a5fe2d1b55faba6d00fd87ad491b6cb603046304"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98670.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98670"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2a9685d1a3b7644ca08d8355fc238b43faef7c3e"},{"fixed":"a29d385ad7b340c952a3935af2b33488db1eb3a6"},{"fixed":"a5fe2d1b55faba6d00fd87ad491b6cb603046304"},{"fixed":"49ea8a359e362bfbb32a647c8eb7962fbb37234e"},{"fixed":"0f3f427076240e75ff265e61645627a71ca4918c"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.10.200"},{"fixed":"5.11"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"e96eb8853f334f96312968e4f01c5a452db54c00"}]}],"versions":["v5.10.272","v5.10.271","v5.10.270","v5.10.269","v5.10.268","v5.10.267","v5.10.266","v5.10.265","v5.10.264","v5.10.263","v5.10.262","v5.10.261","v5.10.260","v5.10.259","v5.10.258","v5.10.257","v5.10.256","v5.10.255","v5.10.254","v5.10.253","v5.10.252","v5.10.251","v5.10.250","v5.10.249","v5.10.248","v5.10.247","v5.10.246","v5.10.245","v5.10.244","v5.10.243","v5.10.242","v5.10.241","v5.10.240","v5.10.239","v5.10.238","v5.10.237","v5.10.236","v5.10.235","v5.10.234","v5.10.233","v5.10.232","v5.10.231","v5.10.230","v5.10.229","v5.10.228","v5.10.227","v5.10.226","v5.10.225","v5.10.224","v5.10.223","v5.10.222","v5.10.221","v5.10.220","v5.10.219","v5.10.218","v5.10.217","v5.10.216","v5.10.215","v5.10.214","v5.10.213","v5.10.212","v5.10.211","v5.10.210","v5.10.209","v5.10.208","v5.10.207","v5.10.206","v5.10.205","v5.10.204","v5.10.203","v5.10.202","v5.10.201","v5.10.200"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98670.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.12.0"},{"fixed":"6.12.113"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.56"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.10"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98670.json"}}],"schema_version":"1.9.0"}