GHSA-6556-HH6Q-QW3C
Vulnerability from github – Published: 2026-10-18 18:31 – Updated: 2026-10-30 15:33In the Linux kernel, the following vulnerability has been resolved:
iio: trigger: cancel reenable_work before freeing trigger
iio_trigger_notify_done_atomic() defers ->reenable() into trig->reenable_work on the system workqueue, and the worker dereferences the owning trigger through container_of(). Nothing cancels this work before iio_trig_release() frees the trigger, so a worker armed by the last in-flight IRQ can outlive the free and touch freed memory.
Cancel it at the top of iio_trig_release(), which every free path reaches through the device core's final put_device().
Found by an in-house static analysis tool.
{
"affected": [],
"aliases": [
"CVE-2026-98656"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-18T16:17:18Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: trigger: cancel reenable_work before freeing trigger\n\niio_trigger_notify_done_atomic() defers -\u003ereenable() into\ntrig-\u003ereenable_work on the system workqueue, and the worker dereferences\nthe owning trigger through container_of(). Nothing cancels this work\nbefore iio_trig_release() frees the trigger, so a worker armed by the\nlast in-flight IRQ can outlive the free and touch freed memory.\n\nCancel it at the top of iio_trig_release(), which every free path\nreaches through the device core\u0027s final put_device().\n\nFound by an in-house static analysis tool.",
"id": "GHSA-6556-hh6q-qw3c",
"modified": "2026-10-30T15:33:54Z",
"published": "2026-10-18T18:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98656"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2a57b9246cecd5dd797a42eb310d6c8816f26d9e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4e790a5bd4249877bcf0c94db12ac490965f9296"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/882d0011c59ff8ac15188ec9ce071399ecfa10ad"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ac5d26a46c90ff61fd574eff4e8f0d71c905828a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/beec4c9e23b8293c41d3448f9807c28fc9a599d4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cf513df1a2c75566cdc802d9da47f62e8d6cfd18"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e64703280ce7a23a43c27efebeb7da457c88bf5c"
}
],
"schema_version": "1.4.0",
"severity": []
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.