CVE-2026-98932

HighCVSS 7.4/10Last modified Oct 24, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

EDAC/altera: Fix use-after-free in error paths

In both altr_edac_a10_device_add() and altr_portb_setup(), the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use altdev(dci->pvt_info) as their data, an IRQ firing between freeing dci and unregistering the IRQs could dereference the freed memory.

Release the devres group first so the managed IRQs are unregistered before the dci structure is freed.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 23, 2026
Last modified
Oct 24, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-98933In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding CVE-2026-98934In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() Since commitCVE-2026-98935In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leakCVE-2026-98936In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar->num_stations on hardware start When (multiple)CVE-2026-98937In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested peCVE-2026-98938In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to request_irq With commitCVE-2026-98939In the Linux kernel, the following vulnerability has been resolved: x86/mm: Drop unnecessary PMD page copy when freeing On a box with a diCVE-2026-98948.3Use after free in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentiCVE-2026-98940In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints ThCVE-2026-989417.0In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable large folios on encrypted inodes Commit 709f0f1f1bfCVE-2026-98942In the Linux kernel, the following vulnerability has been resolved: sched_ext: Build the cid tables privately and publish them with RCU ThCVE-2026-98943In the Linux kernel, the following vulnerability has been resolved: HID: steam: Clean up locking This cleans up several issues with lockin
CVE-2026-98932: High severity, CVSS 7.4 | Vulnix