CVE-2026-98656

A flaw was found in the Linux kernel's Industrial I/O (IIO) subsystem. A race condition occurs when deferred background tasks are not canceled prior to releasing trigger device structures, allowing a worker thread to access memory after it has been freed. A local user could exploit this flaw during device release to cause a Denial of Service (DoS) through a system crash or potentially corrupt kernel memory.

This vulnerability is rated as having Moderate impact for Red Hat Enterprise Linux because exploitation requires local access, specific timing under a race condition, and the presence of active Industrial I/O (IIO) trigger devices, limiting the blast radius primarily to denial of service. Standard enterprise server deployments rarely configure or utilize IIO hardware or software triggers, which significantly reduces practical exposure. Additionally, earlier platforms such as RHEL 7 and RHEL 8 do not contain the vulnerable logic. An attacker would require local authenticated access and precise synchronization while an IIO trigger is dismantled to induce memory corruption or a system crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.