critical · CVSS v3 9.8

CVE-2026-98657

A critical use‑after‑free in the Linux kernel’s IIO proximity pulsedlight driver leaves a device registered after a PM setup failure, leavin

Overview

A critical use‑after‑free in the Linux kernel’s IIO proximity pulsedlight driver leaves a device registered after a PM setup failure, leaving dangling sysfs and character device nodes that point to freed memory. This flaw can crash the system or be used to gain elevated privileges. The kernel now unregisters the device on error to prevent the issue.

Description

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure pm_runtime_set_active() failing in probe() jumps to error_unreg_buffer, which only calls iio_triggered_buffer_cleanup() -- it does not undo the iio_device_register() that already succeeded a few lines above. probe() then returns the error, the devm-managed indio_dev is freed, but the iio core still has it registered: the sysfs/chardev nodes stay live and point at freed memory. Add an error_unreg_dev label that unregisters the iio device before falling through to the existing buffer cleanup, mirroring the teardown order already used in lidar_remove().

Impact

The vulnerability allows attackers to trigger a use‑after‑free that can crash the kernel or lead to privilege escalation, compromising confidentiality, integrity, and availability of the affected system. Defenders should treat it as a high‑risk flaw that can be exploited remotely if the attacker can trigger the faulty probe path. The flaw affects all systems running a kernel version prior to the patch that introduced the error_unreg_dev label.

Remediation

Apply the latest kernel update that includes the fix (e.g., kernel 6.8+ or the specific patch from the vendor). If immediate patching is not possible, disable the pulsedlight IIO driver or block the device from being probed, and enable kernel hardening options such as CONFIG_DEBUG_KERNEL, CONFIG_KASAN, and CONFIG_RCU_USER_QS. Monitor sysfs for dangling nodes and ensure runtime PM is correctly configured.

Risk context

Severity is critical (CVSS 9.8) with no EPSS data, indicating a high likelihood of exploitation in the wild. Defenders should prioritize patching as soon as possible.

Affected products

  • Linux kernel
  • Ubuntu kernel
  • Red Hat kernel
  • Fedora kernel
  • Debian kernel
  • CentOS kernel
  • Arch Linux kernel
  • OpenSUSE kernel

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
—
EPSS
—

kernel iio use-after-free critical privilege-escalation sysfs runtime-pm

← All CVEs

Related CVEs

critical

CVE-2026-98620

A critical kernel bug in the MediaTek Ethernet driver (mtk_eth_soc) causes a BUG_ON when register_netdev() fails, potentially leading to a kernel panic. The flaw occurs during probe failure handling, leaving net_devices in a registered state before they are freed. This can disrupt network services and overall system stability.

View analysis

critical

CVE-2026-98627

CVE-2026-98627 is a critical flaw in the Linux kernel’s BPF subsystem that allows out‑of‑bounds packet pointer accesses due to incorrect displacement handling. The vulnerability can be triggered by malicious BPF programs, potentially enabling memory corruption or privilege escalation. It was fixed by a kernel commit that corrected the pointer offset logic.

View analysis

critical

CVE-2026-98628

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After do_check() returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining instruction and auxiliary-data arrays and adjusts all branch offsets, making the overall work quadratic in the program length. A privileged loader can submit 131072 unconditional jumps by zero followed by a valid return. Verification finishes quickly, but bpf_opt_remove_nops() then spends a long time removing each jump separately. Since this post-verification work neither checks for signals nor reschedules, a pending SIGKILL cannot terminate the task until the rewrite finishes. Make bpf_patch_insn_data() and verifier_remove_insns() common cancellation and rescheduling points. These helpers run from BPF_PROG_LOAD process context, and bpf_patch_insn_data() can already sleep while reallocating auxiliary data. Report interrupted constant blinding as -EINTR and propagate it through both JIT paths, including kernels that permit interpreter fallback. Other blinding failures retain the existing fallback behavior. This does not reduce the quadratic cost of the rewrite passes, but it makes the work preemptible and allows a killed loader to be torn down promptly.

View analysis

critical

CVE-2026-98634

In the Linux kernel, the following vulnerability has been resolved: scsi: sd_zbc: Reject disks with too many zones sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zones field of struct zoned_disk_info, silently truncating counts that exceed 32 bits. The truncated count is later used to size per-zone resources, while the device may still report more zones than fit. Moreover, sd_zbc_report_zones() counts the reported zones with a signed int zone_idx, which overflows past INT_MAX. Reject devices reporting more than INT_MAX zones at scan time; such a device is not realistic for any medium that exists today, and accepting it produces inconsistent zone bookkeeping.

View analysis