CVE-2026-98670

What it actually does

Use-after-free in the Xilinx XADC driver caused by the alarm IRQ handler scheduling zynq_unmask_work after the xadc structure is freed, due to devm callback registration occurring after devm_request_irq.

Why it matters to the business

Recent low-risk kernel flaw affecting Linux systems with Xilinx Zynq hardware; could cause crashes or memory corruption during driver unload on embedded or industrial devices, with minimal active exploitation risk five days after disclosure.

How an attack unfolds

An attacker triggers device unbind or module removal while the alarm IRQ is active, allowing the scheduled delayed work to run after the structure has been freed and resulting in memory corruption.

How to fix it

Register the devm callback before devm_request_irq in the driver so teardown frees the IRQ first; apply the upstream kernel fix once released in the affected branch.

How to confirm the fix worked

Inspect the xilinx-xadc driver source for devm registration ordering before and after the patch; perform repeated bind/unbind cycles while the alarm IRQ is active to confirm no post-free work execution.

Typical attack path

1. Locate a Linux system exposing the xilinx-xadc driver
2. Trigger unbind or removal of the ADC device
3. Ensure the alarm IRQ handler has queued the unmask work via schedule_delayed_work
4. Trigger execution of the freed work item

How to detect it

Examine kernel logs for oops or use-after-free reports referencing xilinx-xadc or zynq_unmask_work during module unload; correlate with device removal events in dmesg.

What your security team should do

• Track kernel updates for the xilinx-xadc fix given the five-day disclosure window
• Limit device unbind operations on production systems until patched
• Review static-analysis results on similar drivers for comparable ordering issues