net: airoha: npu: cancel wdt_work after releasing the WDT IRQ

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-98496
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-18 16:17:00 UTC
Updated2026-10-19 10:19:02 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdt_work after releasing the WDT IRQ airoha_npu_remove() calls cancel_work_sync() on each core's wdt_work, but the watchdog IRQ that queues it is requested with devm_request_irq() and is freed only after .remove() returns. airoha_npu_wdt_handler() can therefore schedule_work() again once the cancel has returned. struct airoha_npu, which contains the work, is devm_kzalloc()'d and is freed in that same unwind, so the late work dereferences freed memory. Register the work with devm_work_autocancel() before devm_request_irq() and drop .remove(). Devres runs in reverse order, so the IRQ is freed before cancel_work_sync(), including when probe fails. A cancel left in .remove() cannot get that order. Initializing the work first also stops a pending watchdog interrupt from queuing an uninitialized work item. Probe currently calls INIT_WORK() only after devm_request_irq(). This issue was identified during our ongoing static-analysis research while reviewing kernel code.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 23290c7bc190def4e1ca61610992d9b7c32e33f3 aca91d8fa0ecbc990ebf9a688c684dda78a43c00 git Not specified
CNA Linux Linux affected 23290c7bc190def4e1ca61610992d9b7c32e33f3 da9d42531f3a6dfea2e9c775b62a46185dbf280a git Not specified
CNA Linux Linux affected 23290c7bc190def4e1ca61610992d9b7c32e33f3 4bdee8060d1e4581624e68fbd369b1afb14df4bc git Not specified
CNA Linux Linux affected 6.15 Not specified
CNA Linux Linux unaffected 6.15 semver Not specified
CNA Linux Linux unaffected 6.18.55 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.9 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/aca91d8fa0ecbc990ebf9a688c684dda78a43c00 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4bdee8060d1e4581624e68fbd369b1afb14df4bc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/da9d42531f3a6dfea2e9c775b62a46185dbf280a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report