CVE-2026-98662Medium· 4.7▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap020a00f: drain irq_work after free_irq The threaded IRQ handler queues data->work through irq_work_queue() so the trigger is polled from a per-CPU con…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 25.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
— → 4.7
none → medium
Last analysed / modified upstream
In the Linux kernel, the following vulnerability has been resolved:
iio: light: gp2ap020a00f: drain irq_work after free_irq
The threaded IRQ handler queues data->work through irq_work_queue() so the trigger is polled from a per-CPU context. free_irq() does not flush an irq_work the handler already queued, so after gp2ap020a00f_remove() returns that work may still run and call iio_trigger_poll() on data->trig, which the devm cleanup has already freed, causing a use-after-free.
Add irq_work_sync(&data->work) after free_irq() in remove() and in the probe error path, mirroring commit 78601726d4a5 ("iio: trigger: sysfs: fix use-after-free on remove").
Found by an in-house static analysis tool, confirmed by manual review.
Linux >= bf29fbeaa13d3350ca71df70c705d8b883c45692 < 85c20d1cf3f01a506605a16c2f9ce23b9c8b114fLinux >= bf29fbeaa13d3350ca71df70c705d8b883c45692 < a36814b9fe00970116d30c3143d81e7425c4d334Linux >= bf29fbeaa13d3350ca71df70c705d8b883c45692 < cc71400bc965c0d3894a38ead3d71243400c2d5eLinux >= bf29fbeaa13d3350ca71df70c705d8b883c45692 < a1769877ff52a4f1bfb9ca535d1b5113808bd602Linux >= bf29fbeaa13d3350ca71df70c705d8b883c45692 < 63213927b141085b6c8719b8037dab3074b7e0feLinux 3.13Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-39977High· 7.8In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 T2 futex_wait_requeue_pi() fute…
CVE-2024-57804High· 7.3scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
CVE-2024-47794High· 7.8bpf: Prevent tailcall infinite loop caused by freplace
CVE-2026-100070Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet sashiko says: If map_addr() changes the packet length, such as when the public NAT IP string is shor…
CVE-2026-100071Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before t…
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing