Cloudanix VulnDB

CVE-2026-98740

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain Linux systems could let the kernel try to use memory that has already been cleaned up, potentially causing crashes during hardware setup.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free when __init-marked EDAC setup callbacks for Altera devices (sdmmc, ethernet, nand, dma, usb, qspi) are invoked from a deferred or rebound probe after init memory has been released.

Why it matters to the business

Kernel instability or crashes on affected embedded Linux systems using Altera/Intel FPGA EDAC drivers, increasing downtime risk especially during module load or device re-probe events.

How an attack unfolds

An attacker with local access triggers a probe deferral (via -EPROBE_DEFER) or manual unbind/rebind of the EDAC driver after init memory is freed, causing the still-registered callbacks to dereference invalid memory.

How to fix it

Upgrade to a kernel containing the fix that removes __init annotations from altr_init_a10_ecc_device_type, altr_init_a10_ecc_block, and the associated .setup callbacks; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the driver source no longer uses __init on the listed functions, verify successful probe after init memory release via dmesg, and ensure sysfs unbind/rebind completes without oops.

Typical attack path

  1. Gain local access or ability to influence device probe timing
  2. Force -EPROBE_DEFER or unbind/rebind of altr_edac driver
  3. Trigger execution of freed __init code paths in ECC setup helpers
  4. Induce kernel panic or memory corruption

How to detect it

Review kernel logs for oops or warnings referencing altr_edac, altr_init_a10_ecc, or EPROBE_DEFER around device probe times; inspect for unexpected EDAC driver unbind/rebind events.

What your security team should do

  • Prioritize patching kernel packages on any Altera/Intel FPGA platforms within standard maintenance windows
  • Monitor for EDAC probe-related kernel oops in logs on systems using these drivers
  • Apply defense-in-depth by restricting local unprivileged access where possible

The record

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Drop __init from ECC setup paths for re-probe safety Sashiko reports: "Does suppressing sysfs unbinding fully prevent the execution of freed __init memory? If altr_sysmgr_regmap_lookup_by_phandle() returns -EPROBE_DEFER, the probe is deferred until after __init memory is freed." The a10 EDAC .setup callbacks (sdmmc, ethernet, nand, dma, usb, qspi) and their helpers (altr_init_a10_ecc_device_type, altr_init_a10_ecc_block) were marked __init. These run from the probe path, which may execute after init memory is freed -- e.g. a probe deferred via -EPROBE_DEFER that only succeeds once a late/module dependency appears, or a manual unbind/rebind. Calling __init code then dereferences freed memory. Remove __init so these functions remain valid at runtime.

Affected packages

Ecosystem Package Introduced Fixed