{"id":"CVE-2026-98740","title":"kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety (CVE-2026-98740)","summary":"A flaw was found in the Linux kernel's Altera Error Detection and Correction (EDAC) driver. Certain setup functions were incorrectly designated as temporary initialization routines that are released from memory after startup. When device r…","severity":"medium","cvss":4.1,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-825","vendor":"Red Hat","product":"Linux","affected":["Linux >= 788586efd116d6d7d05985881eda503333e702b4 < 9846b85c2eb8b749c3f14bdcc31b1070f6aabba8","Linux >= 788586efd116d6d7d05985881eda503333e702b4 < 4ec26cb7984740941892ad21fa974963c198bfaa","Linux >= 788586efd116d6d7d05985881eda503333e702b4 < b62a264163ca51bee04785c581344751812395df","Linux 5.2"],"published":"2026-10-18","updated":"2026-10-23","sourceUpdated":"2026-10-23T02:01:02+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98740.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98740.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98740"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555193"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98740"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98740"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98740.mbox"},{"url":"https://git.kernel.org/stable/c/9846b85c2eb8b749c3f14bdcc31b1070f6aabba8"},{"url":"https://git.kernel.org/stable/c/4ec26cb7984740941892ad21fa974963c198bfaa"},{"url":"https://git.kernel.org/stable/c/b62a264163ca51bee04785c581344751812395df"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00178,"epssPercentile":0.07365,"ingestedAt":"2026-10-18T16:47:32.503Z","slug":"CVE-2026-98740","body":"## Overview\n\nA flaw was found in the Linux kernel's Altera Error Detection and Correction (EDAC) driver. Certain setup functions were incorrectly designated as temporary initialization routines that are released from memory after startup. When device registration is deferred or manually re-triggered, the driver attempts to execute code from this released memory. A local user with administrative access or specific boot conditions can trigger this vulnerability, leading to a Denial of Service (DoS) via a system crash or kernel memory corruption.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98740.json)\n\n**kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":22.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":228218,"id":"CVE-2026-98740","ts":1792758200673,"field":"cvss","old":null,"new":"4.1"},{"seq":228217,"id":"CVE-2026-98740","ts":1792758200673,"field":"severity","old":"none","new":"medium"}]}