Cloudanix VulnDB

CVE-2026-98657

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel manages certain distance sensors can leave internal references pointing to deleted memory, risking crashes or unauthorized access on affected devices.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free where iio_device_register succeeds but an error in pm_runtime_set_active causes the indio_dev to be devm-freed while still registered in the IIO core, leaving sysfs and chardev nodes pointing at freed memory.

Why it matters to the business

Kernel instability or memory corruption on systems using the pulsedlight proximity sensor can lead to crashes, reduced availability, and potential local privilege escalation on affected Linux devices.

How an attack unfolds

An attacker with local access forces the probe error path by manipulating power-management conditions, then interacts with the lingering sysfs or character-device interfaces to access or corrupt the freed IIO device structure.

How to fix it

Apply the upstream kernel patch that adds an error_unreg_dev label to call iio_device_unregister before buffer cleanup; rebuild and deploy the fixed kernel on all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the lidar probe function for the additional error_unreg_dev path; test probe failure injection and verify the device nodes are correctly torn down.

Typical attack path

  1. Trigger pm_runtime_set_active failure during driver probe
  2. Allow devm release to free the registered indio_dev
  3. Access dangling sysfs/chardev nodes from user space
  4. Read or write the freed memory to trigger use-after-free

How to detect it

Inspect kernel logs for oops or slab corruption involving iio_device structures during pulsedlight probe; search dmesg and audit logs for unexpected accesses to /sys/bus/iio or /dev/iio device nodes shortly after driver load failures.

What your security team should do

  • Prioritize kernel update on all systems exposing the pulsedlight driver
  • Restrict unprivileged local access until patched
  • Monitor kernel oops and slab-use-after-free reports

The record

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure pm_runtime_set_active() failing in probe() jumps to error_unreg_buffer, which only calls iio_triggered_buffer_cleanup() -- it does not undo the iio_device_register() that already succeeded a few lines above. probe() then returns the error, the devm-managed indio_dev is freed, but the iio core still has it registered: the sysfs/chardev nodes stay live and point at freed memory. Add an error_unreg_dev label that unregisters the iio device before falling through to the existing buffer cleanup, mirroring the teardown order already used in lidar_remove().

Affected packages

Ecosystem Package Introduced Fixed