CVE-2026-98938 rust: irq: pass RegistrationInner as cookie to request_irq
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-98938?
CVE-2026-98938 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rust: irq: pass RegistrationInner as cookie to request_irq
With commit ba268514ea14 ("rust: devres: fix race condition due to nesting"), Devres::new() returns Result<Self> by value instead of initializing in-place via PinInit. Because request_irq() is called inside Devres::new(), registration.inner is still uninitialized when the IRQ is enabled, so accessing registration.inner.device() in the IRQ callback can read uninitialized memory.
Fix this by storing the Device and handler pointer in RegistrationInner and passing RegistrationInner as the IRQ cookie after its fields are initialized.
This is not needed in mainline because commit 98c63ce4d760 ("rust: irq: make Registration compatible with lifetime-bound drivers") removed Devres from irq::Registration and moved request_irq() after all fields are initialized.
Which versions are affected by CVE-2026-98938?
How do I fix CVE-2026-98938?
Upgrade to a fixed version.
Is CVE-2026-98938 being exploited?
There is no known exploitation of CVE-2026-98938 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98938, DEBIAN-CVE-2026-98938, GHSA-4546-wrv4-93xw, UBUNTU-CVE-2026-98938.