Cloudanix VulnDB

CVE-2026-98721

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A startup timing problem in certain storage hardware drivers could cause a computer to crash if an interrupt arrives at exactly the wrong moment.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Race condition allowing a pending interrupt to access uninitialized IRQ lock and completion objects because the handler is registered before these primitives are initialized in the Cadence NAND driver.

Why it matters to the business

Potential kernel instability, crashes during boot or driver load on systems using Cadence NAND controllers, increasing downtime risk for storage-dependent workloads; low EPSS and no KEV status indicate limited immediate operational urgency.

How an attack unfolds

An attacker triggers or schedules a pending interrupt during the brief window after IRQ registration but before lock and completion initialization, causing the handler to dereference uninitialized synchronization state and induce memory corruption or panic.

How to fix it

Initialize the IRQ lock and completion object before calling request_irq in the driver; apply the upstream kernel commit that resolves the ordering issue.

How to confirm the fix worked

Inspect the rawnand cadence driver source to confirm lock and completion initialization precede IRQ registration; stress-test driver load paths with simulated pending interrupts to verify absence of the race.

Typical attack path

  1. Load or probe the Cadence NAND driver (module init or device enumeration)
  2. Arrange for a pending interrupt to fire immediately after request_irq
  3. Interrupt handler executes with uninitialized lock/completion, triggering undefined behavior or crash

How to detect it

Review kernel boot logs and dmesg for oops, panic, or warning messages referencing the cadence NAND interrupt handler or uninitialized synchronization objects during driver probe.

What your security team should do

  • Apply the fix to all kernels containing the Cadence NAND driver within standard patch cycles
  • Include the updated driver in next kernel build or distribution update
  • Monitor mainline kernel changelogs for related NAND changes

The record

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ The Cadence NAND interrupt handler uses both the IRQ lock and completion object. Registering the IRQ before initializing them leaves a window in which a pending interrupt can access uninitialized synchronization state. Initialize them before registering the handler.

Affected packages

Ecosystem Package Introduced Fixed