Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-18T00:00:00 kernel: iio: trigger: cancel reenable_work before freeing trigger 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-825

In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenable_work before freeing trigger iio_trigger_notify_done_atomic() defers ->reenable() into trig->reenable_work on the system workqueue, and the worker dereferences the owning trigger through container_of(). Nothing cancels this work before iio_trig_release() frees the trigger, so a worker armed by the last in-flight IRQ can outlive the free and touch freed memory. Cancel it at the top of iio_trig_release(), which every free path reaches through the device core's final put_device(). Found by an in-house static analysis tool.

A flaw was found in the Linux kernel's Industrial I/O (IIO) subsystem. A race condition occurs when deferred background tasks are not canceled prior to releasing trigger device structures, allowing a worker thread to access memory after it has been freed. A local user could exploit this flaw during device release to cause a Denial of Service (DoS) through a system crash or potentially corrupt kernel memory.

This vulnerability is rated as having Moderate impact for Red Hat Enterprise Linux because exploitation requires local access, specific timing under a race condition, and the presence of active Industrial I/O (IIO) trigger devices, limiting the blast radius primarily to denial of service. Standard enterprise server deployments rarely configure or utilize IIO hardware or software triggers, which significantly reduces practical exposure. Additionally, earlier platforms such as RHEL 7 and RHEL 8 do not contain the vulnerable logic. An attacker would require local authenticated access and precise synchronization while an IIO trigger is dismantled to induce memory corruption or a system crash. Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 Fix deferred openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-98656 https://nvd.nist.gov/vuln/detail/CVE-2026-98656 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98656.mbox