CVE-2026-98656
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
iio: trigger: cancel reenable_work before freeing trigger
iio_trigger_notify_done_atomic() difiere ->reenable() en trig->reenable_work en la cola de trabajo del sistema, y el worker desreferencia el disparador propietario a través de container_of(). Nada cancela este trabajo antes de que iio_trig_release() libere el disparador, por lo que un worker armado por la última IRQ en vuelo puede sobrevivir a la liberación y acceder a memoria liberada.
Cancelarlo al inicio de iio_trig_release(), a lo que llega toda ruta de liberación a través del put_device() final del núcleo del dispositivo.
Leer descripción completaMostrar menos
Detectado con una herramienta de análisis estático interna.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.17 %
- Percentil entre todas las CVEs puntuadas
- 6
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 4 referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98656",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "9020ef659885f2622cfb386cc229b6d618362895",
"lessThan": "cf513df1a2c75566cdc802d9da47f62e8d6cfd18",
"versionType": "git"
},
{
"status": "affected",
"version": "9020ef659885f2622cfb386cc229b6d618362895",
"lessThan": "e64703280ce7a23a43c27efebeb7da457c88bf5c",
"versionType": "git"
},
{
"status": "affected",
"version": "9020ef659885f2622cfb386cc229b6d618362895",
"lessThan": "882d0011c59ff8ac15188ec9ce071399ecfa10ad",
"versionType": "git"
},
{
"status": "affected",
"version": "9020ef659885f2622cfb386cc229b6d618362895",
"lessThan": "2a57b9246cecd5dd797a42eb310d6c8816f26d9e",
"versionType": "git"
},
{
"status": "affected",
"version": "a18aeac73c0f692ba40964f5f56e182312ae843b",
"versionType": "git"
},
{
"status": "affected",
"version": "2c5c948451d57596640b20887b06b523d376eb24",
"versionType": "git"
},
{
"status": "affected",
"version": "5.15.17",
"lessThan": "5.16",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.16.3",
"lessThan": "5.17",
"versionType": "semver"
}
],
"programFiles": [
"drivers/iio/industrialio-trigger.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/iio/industrialio-trigger.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:18.907",
"references": [
{
"url": "https://git.kernel.org/stable/c/2a57b9246cecd5dd797a42eb310d6c8816f26d9e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/882d0011c59ff8ac15188ec9ce071399ecfa10ad",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cf513df1a2c75566cdc802d9da47f62e8d6cfd18",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e64703280ce7a23a43c27efebeb7da457c88bf5c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: trigger: cancel reenable_work before freeing trigger\n\niio_trigger_notify_done_atomic() defers ->reenable() into\ntrig->reenable_work on the system workqueue, and the worker dereferences\nthe owning trigger through container_of(). Nothing cancels this work\nbefore iio_trig_release() frees the trigger, so a worker armed by the\nlast in-flight IRQ can outlive the free and touch freed memory.\n\nCancel it at the top of iio_trig_release(), which every free path\nreaches through the device core's final put_device().\n\nFound by an in-house static analysis tool."
}
],
"lastModified": "2026-10-19T10:19:30.000",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}