---
id: CVE-2026-98740
title: >-
  kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety
  (CVE-2026-98740)
summary: >-
  A flaw was found in the Linux kernel's Altera Error Detection and Correction
  (EDAC) driver. Certain setup functions were incorrectly designated as
  temporary initialization routines that are released from memory after startup.
  When device r…
severity: medium
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-825
vendor: Red Hat
product: Linux
affected:
  - >-
    Linux >= 788586efd116d6d7d05985881eda503333e702b4 <
    9846b85c2eb8b749c3f14bdcc31b1070f6aabba8
  - >-
    Linux >= 788586efd116d6d7d05985881eda503333e702b4 <
    4ec26cb7984740941892ad21fa974963c198bfaa
  - >-
    Linux >= 788586efd116d6d7d05985881eda503333e702b4 <
    b62a264163ca51bee04785c581344751812395df
  - Linux 5.2
published: '2026-10-18'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T02:01:02+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98740.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98740.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98740'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555193'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98740'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98740'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98740.mbox
  - url: 'https://git.kernel.org/stable/c/9846b85c2eb8b749c3f14bdcc31b1070f6aabba8'
  - url: 'https://git.kernel.org/stable/c/4ec26cb7984740941892ad21fa974963c198bfaa'
  - url: 'https://git.kernel.org/stable/c/b62a264163ca51bee04785c581344751812395df'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00178
epssPercentile: 0.07365
ingestedAt: '2026-10-18T16:47:32.503Z'
---

## Overview

A flaw was found in the Linux kernel's Altera Error Detection and Correction (EDAC) driver. Certain setup functions were incorrectly designated as temporary initialization routines that are released from memory after startup. When device registration is deferred or manually re-triggered, the driver attempts to execute code from this released memory. A local user with administrative access or specific boot conditions can trigger this vulnerability, leading to a Denial of Service (DoS) via a system crash or kernel memory corruption.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98740.json)

**kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Refer to the advisory for fix availability.