https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 03 Nov 2026 20:08:07 +0000 https://db.gcve.eu/vuln/cve-2026-98662 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>iio: light: gp2ap020a00f: drain irq_work after free_irq</p> <p>The threaded IRQ handler queues data-&gt;work through irq_work_queue() so the trigger is polled from a per-CPU context. free_irq() does not flush an irq_work the handler already queued, so after gp2ap020a00f_remove() returns that work may still run and call iio_trigger_poll() on data-&gt;trig, which the devm cleanup has already freed, causing a use-after-free.</p> <p>Add irq_work_sync(&amp;data-&gt;work) after free_irq() in remove() and in the probe error path, mirroring commit 78601726d4a5 (&#34;iio: trigger: sysfs: fix use-after-free on remove&#34;).</p> <p>Found by an in-house static analysis tool, confirmed by manual review.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>iio: light: gp2ap020a00f: drain irq_work after free_irq</p> <p>The threaded IRQ handler queues data-&gt;work through irq_work_queue() so the trigger is polled from a per-CPU context. free_irq() does not flush an irq_work the handler already queued, so after gp2ap020a00f_remove() returns that work may still run and call iio_trigger_poll() on data-&gt;trig, which the devm cleanup has already freed, causing a use-after-free.</p> <p>Add irq_work_sync(&amp;data-&gt;work) after free_irq() in remove() and in the probe error path, mirroring commit 78601726d4a5 (&#34;iio: trigger: sysfs: fix use-after-free on remove&#34;).</p> <p>Found by an in-house static analysis tool, confirmed by manual review.</p> https://db.gcve.eu/vuln/cve-2026-98662