CVE-2026-98496 net: airoha: npu: cancel wdt_work after releasing the WDT IRQ
A use-after-free in the Airoha NPU driver allows attackers to execute code or cause a denial of service via race conditions during device removal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98496?
CVE-2026-98496 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: airoha: npu: cancel wdt_work after releasing the WDT IRQ
airoha_npu_remove() calls cancel_work_sync() on each core's wdt_work, but the watchdog IRQ that queues it is requested with devm_request_irq() and is freed only after .remove() returns. airoha_npu_wdt_handler() can therefore schedule_work() again once the cancel has returned. struct airoha_npu, which contains the work, is devm_kzalloc()'d and is freed in that same unwind, so the late work dereferences freed memory.
Register the work with devm_work_autocancel() before devm_request_irq() and drop .remove(). Devres runs in reverse order, so the IRQ is freed before cancel_work_sync(), including when probe fails. A cancel left in .remove() cannot get that order. Initializing the work first also stops a pending watchdog interrupt from queuing an uninitialized work item. Probe currently calls INIT_WORK() only after devm_request_irq().
This issue was identified during our ongoing static-analysis research while reviewing kernel code.
Which versions are affected by CVE-2026-98496?
How do I fix CVE-2026-98496?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98496 being exploited?
There is no known exploitation of CVE-2026-98496 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98496, DEBIAN-CVE-2026-98496, GHSA-qq9m-vqcj-573m, UBUNTU-CVE-2026-98496.