CVE-2026-98670

A flaw was found in the Linux kernel's Xilinx XADC driver. During device unbinding, an improper cleanup order allows interrupt requests (IRQs) to remain active after delayed work has been cancelled. A local user capable of detaching the device can cause an interrupt to schedule work that executes after device memory has been freed, leading to a use-after-free condition. This flaw primarily results in a Denial of Service (DoS) via a kernel crash, or potentially enables arbitrary code execution.

An incorrect devres teardown order in the Xilinx Zynq XADC driver can allow the alarm IRQ handler to queue zynq_unmask_work after the delayed work was already cancelled. The queued worker may then run after the containing xadc structure has been freed, creating a use-after-free condition. The most direct impact is a kernel crash and local denial of service. Reuse of the freed work item memory may also create a potential path to kernel memory corruption or privilege escalation, although a reliable controlled write primitive is not established by the available code. For the CVSS the PR:H reflects that driver unbind or device removal normally requires administrative control on the host. AC:H reflects the narrow race window between work cancellation and IRQ release. The issue is not network reachable and requires affected Xilinx Zynq XADC hardware with the relevant interrupt path active.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.