CVE-2026-98496: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98496 Overview

CVE-2026-98496 is a use-after-free vulnerability in the Linux kernel's Airoha Network Processing Unit (NPU) driver. The flaw resides in the airoha_npu_remove() teardown path, where the watchdog interrupt handler can schedule work on a structure that has already been freed. The vulnerability was identified through static-analysis research of kernel code and resolved by reordering devres registration so the watchdog IRQ is released before cancel_work_sync() runs.

Critical Impact
A race between the watchdog IRQ handler and driver removal can dereference freed kernel memory, potentially leading to kernel memory corruption or a denial-of-service condition on systems using the Airoha NPU driver.

Affected Products

Linux kernel builds including the airoha_npu network driver
Devices using Airoha NPU hardware with the mainline driver
Downstream distributions shipping the affected driver prior to the fix commits

Discovery Timeline

2026-10-18 - CVE-2026-98496 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98496

Vulnerability Analysis

The Airoha NPU driver maintains a per-core wdt_work work item that the watchdog interrupt handler airoha_npu_wdt_handler() queues via schedule_work(). During driver teardown, airoha_npu_remove() calls cancel_work_sync() on each core's wdt_work. However, the watchdog IRQ is requested with devm_request_irq(), meaning devres only releases the IRQ after .remove() returns.

This ordering allows the IRQ handler to fire and call schedule_work() after cancel_work_sync() has already completed. The surrounding struct airoha_npu is allocated with devm_kzalloc() and freed in the same devres unwind, so the newly queued work dereferences memory that has been released. This is a classic use-after-free [CWE-416] triggered by incorrect teardown ordering.

A secondary issue existed at probe time: INIT_WORK() ran only after devm_request_irq(), so an early watchdog interrupt could queue an uninitialized work item.

Root Cause

The root cause is improper lifecycle management between a managed IRQ and a work item. Because devres resources are released in reverse registration order, placing cancel_work_sync() in a manual .remove() callback cannot guarantee the IRQ is freed first. The handler remains armed while cleanup proceeds.

Attack Vector

Exploitation requires local triggering of the driver removal path concurrently with watchdog interrupt activity on an affected device. Successful races produce kernel memory corruption, kernel panics, or related memory-safety faults in the airoha_npu subsystem. No remote network vector is documented.

The fix registers the work with devm_work_autocancel() before devm_request_irq() and removes the .remove() callback entirely. Devres then runs cleanup in reverse order, releasing the IRQ before cancelling the work and freeing the structure. See the upstream fix at Kernel Git Commit 4bdee80, Kernel Git Commit aca91d8, and Kernel Git Commit da9d42.

Detection Methods for CVE-2026-98496

Indicators of Compromise

Kernel oops or panic messages referencing airoha_npu, wdt_work, or schedule_work during module unload or device removal.
KASAN use-after-free reports pointing to airoha_npu_wdt_handler or the wdt_work structure.
Unexpected system instability on Airoha NPU-equipped devices during driver reload cycles.

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test builds to surface use-after-free conditions in the airoha_npu driver.
Audit running kernel versions against the fix commits listed in the upstream references.
Correlate dmesg output across fleet endpoints for crash patterns tied to NPU teardown.

Monitoring Recommendations

Monitor kernel logs for repeated crashes on devices using Airoha networking hardware.
Track package versions of the Linux kernel across managed Linux hosts and embedded devices.
Centralize kernel crash dumps and dmesg telemetry to a SIEM for retrospective analysis.

How to Mitigate CVE-2026-98496

Immediate Actions Required

Identify Linux systems and embedded devices shipping the airoha_npu driver and schedule kernel updates.
Apply vendor-supplied kernel updates containing the fix commits as soon as they are released for your distribution.
Avoid repeated unload/reload cycles of the airoha_npu module on unpatched systems to reduce the race window.

Patch Information

The fix is distributed across three upstream commits that register wdt_work with devm_work_autocancel() before requesting the watchdog IRQ and remove the manual .remove() handler. Review the patches at Kernel Git Commit 4bdee80, Kernel Git Commit aca91d8, and Kernel Git Commit da9d42. Rebuild and deploy kernels with these commits included.

Workarounds

Where feasible, blacklist the airoha_npu module on hosts that do not require NPU functionality until a patched kernel is deployed.
Restrict local privileged access that could trigger driver removal operations on affected systems.
Pin device firmware and driver configurations to minimize unexpected watchdog interrupt activity during maintenance windows.

bash

# Verify whether the airoha_npu module is loaded
lsmod | grep airoha_npu

# Prevent automatic loading until a patched kernel is installed
echo "blacklist airoha_npu" | sudo tee /etc/modprobe.d/blacklist-airoha-npu.conf
sudo update-initramfs -u