CVE-2026-98768

What it actually does

Race condition in the anx7411 USB Type-C driver where a devm-managed IRQ can still schedule work on a workqueue after remove() begins tearing it down, leading to use-after-free or invalid memory access.

Why it matters to the business

Systems using affected Linux kernels with this hardware may experience crashes, instability, or denial of service during device removal or hotplug events; low exploitation likelihood but high urgency on embedded or server platforms due to recent publication.

How an attack unfolds

An attacker with local access triggers rapid device insertion/removal or module unload to race the IRQ handler against workqueue destruction, potentially causing kernel panic; no public exploits or threat actors observed.

How to fix it

Update to a Linux kernel containing the fix that disables the IRQ before destroying the workqueue; apply the patch from the upstream commit resolving this issue.

How to confirm the fix worked

Confirm the kernel version includes the anx7411 IRQ disable-before-workqueue-destroy change; inspect driver source for explicit disable_irq or similar before destroy_workqueue calls.

Typical attack path

1. Obtain local access to a system running a vulnerable kernel with anx7411 hardware
2. Trigger repeated hotplug or driver unload events
3. Race the IRQ against workqueue teardown to trigger memory corruption
4. Escalate to denial of service or attempt further kernel exploitation

How to detect it

Review kernel logs for workqueue or IRQ-related warnings during device removal; look for oops or panic traces involving anx7411 or plat->work; no public IOCs available.

What your security team should do

• Prioritize kernel updates on all systems with USB Type-C anx7411 hardware within the next patch cycle
• Monitor EPSS and KEV status for any increase in exploit activity
• Test device hotplug/remove paths in lab environments before production rollout