CVE-2026-98656

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iio: trigger: cancel reenable_work before freeing trigger

iio_trigger_notify_done_atomic() defers ->reenable() into

trig->reenable_work on the system workqueue, and the worker dereferences

the owning trigger through container_of(). Nothing cancels this work

before iio_trig_release() frees the trigger, so a worker armed by the

last in-flight IRQ can outlive the free and touch freed memory.

Cancel it at the top of iio_trig_release(), which every free path

reaches through the device core's final put_device().

Found by an in-house static analysis tool.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References