CVE-2026-98496

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: npu: cancel wdt_work after releasing the WDT IRQ

airoha_npu_remove() calls cancel_work_sync() on each core's wdt_work,

but the watchdog IRQ that queues it is requested with devm_request_irq()

and is freed only after .remove() returns. airoha_npu_wdt_handler() can

therefore schedule_work() again once the cancel has returned. struct

airoha_npu, which contains the work, is devm_kzalloc()'d and is freed in

that same unwind, so the late work dereferences freed memory.

Register the work with devm_work_autocancel() before devm_request_irq()

and drop .remove(). Devres runs in reverse order, so the IRQ is freed

before cancel_work_sync(), including when probe fails. A cancel left in

.remove() cannot get that order. Initializing the work first also stops

a pending watchdog interrupt from queuing an uninitialized work item.

Probe currently calls INIT_WORK() only after devm_request_irq().

This issue was identi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References