CVE-2026-98670
Description
A flaw was found in the Linux kernel's Xilinx XADC driver. During device unbinding, an improper cleanup order allows interrupt requests (IRQs) to remain active after delayed work has been cancelled. A local user capable of detaching the device can cause an interrupt to schedule work that executes after device memory has been freed, leading to a use-after-free condition. This flaw primarily results in a Denial of Service (DoS) via a kernel crash, or potentially enables arbitrary code execution.
Statement
An incorrect devres teardown order in the Xilinx Zynq XADC driver can allow the alarm IRQ handler to queue zynq_unmask_work after the delayed work was already cancelled. The queued worker may then run after the containing xadc structure has been freed, creating a use-after-free condition. The most direct impact is a kernel crash and local denial of service. Reuse of the freed work item memory may also create a potential path to kernel memory corruption or privilege escalation, although a reliable controlled write primitive is not established by the available code. For the CVSS the PR:H reflects that driver unbind or device removal normally requires administrative control on the host. AC:H reflects the narrow race window between work cancellation and IRQ release. The issue is not network reachable and requires affected Xilinx Zynq XADC hardware with the relevant interrupt path active.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.1 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | High | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
