CVE-2026-98932
High · 7.4CVSS
7.4
EPSS
0.2%
Published
Oct 23, 2026
CISA due date
—
Cloudanix analysis
A memory handling mistake in the Linux kernel on certain hardware could let an attacker who already has access to the machine cause crashes or run unwanted code.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- High
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Use-after-free in altr_edac_a10_device_add and altr_portb_setup error paths where the dci structure is freed before the managed devres group, allowing IRQ handlers that reference dci->pvt_info to dereference freed memory.
Why it matters to the business
Systems running affected Linux kernels may experience kernel instability, crashes, or potential memory corruption leading to denial of service or limited code execution under specific hardware and error conditions.
How an attack unfolds
An attacker with local access triggers an error path during Altera EDAC device initialization on supported hardware, causing the dci structure to be released prematurely; if a managed IRQ fires in the window before devres cleanup, the handler dereferences the freed memory, potentially leading to a crash or controlled memory access.
How to fix it
Update to a Linux kernel containing the fix that releases the devres group before freeing the dci structure; rebuild and deploy the patched kernel across affected systems.
How to confirm the fix worked
Verify the presence of the corrected error-path ordering in the EDAC/altera source or confirm the running kernel version incorporates the upstream resolution for the described use-after-free.
Typical attack path
- Gain local access to a system with Altera EDAC hardware enabled
- Trigger error conditions in altr_edac_a10_device_add or altr_portb_setup
- Exploit the window between dci free and IRQ unregistration to dereference freed memory
How to detect it
Search kernel logs for oops traces or warnings referencing EDAC/altera IRQ handlers and dci structures around device initialization failures; examine crash dumps for use-after-free patterns in managed IRQ paths.
What your security team should do
- Prioritize kernel updates on systems with Altera EDAC support within standard patching cycles given low EPSS and absence from KEV
- Monitor for kernel oops or panics involving EDAC IRQ handlers
- Review hardware configurations to determine exposure scope
The record
In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altr_edac_a10_device_add() and altr_portb_setup(), the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use altdev(dci->pvt_info) as their data, an IRQ firing between freeing dci and unregistering the IRQs could dereference the freed memory. Release the devres group first so the managed IRQs are unregistered before the dci structure is freed.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|