CVE-2026-98670: Linux Kernel XADC Use-After-Free Vulnerability

CVE-2026-98670 Overview

CVE-2026-98670 affects the Linux kernel's Industrial I/O (IIO) subsystem, specifically the xilinx-xadc analog-to-digital converter driver used on Xilinx ZYNQ platforms. The driver registers an alarm interrupt handler that schedules zynq_unmask_work through schedule_delayed_work(). Due to incorrect ordering of device-managed (devm) cleanup callbacks, the delayed work can be re-armed after the backing xadc structure has been released. An in-house static analysis tool identified the flaw, and maintainers merged fixes across multiple stable branches.

Critical Impact
On driver unbind, the IRQ handler can queue work that executes after the associated memory is freed, producing a potential use-after-free in kernel context.

Affected Products

Linux kernel iio/adc/xilinx-xadc driver
Xilinx ZYNQ XADC-equipped platforms running affected kernel branches
Downstream distributions shipping unpatched Linux stable trees

Discovery Timeline

2026-10-18 - CVE-2026-98670 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98670

Vulnerability Analysis

The xilinx-xadc driver uses the device-managed resource (devres) framework to tie resource lifetimes to the device. The ZYNQ alarm IRQ handler calls schedule_delayed_work() to queue zynq_unmask_work. A separate devm callback is responsible for cancelling that pending work during teardown.

The root issue is ordering. The teardown callback that cancels the work was registered after devm_request_irq(). Because devres runs cleanup in last-in-first-out order, the work-cancel callback executes before the IRQ is freed. Between those two steps, the still-active IRQ handler can fire and queue new work. Once the xadc structure is released, the deferred handler dereferences freed memory, resulting in a use-after-free condition in the kernel.

Root Cause

The defect is an improper teardown sequence in the driver's unbind path, a classic ordering flaw in resource lifecycle management. The IRQ remains serviceable after its associated worker-cancel barrier has already run.

Attack Vector

Triggering the condition requires driver unbind while the hardware generates alarm interrupts. On ZYNQ systems, this is realistic during module reload, device hot-unplug, suspend/resume transitions, or administrative operations that remove the driver. Exploitation primitives depend on kernel heap layout and timing of the delayed work after the free.

No verified public exploit code is available. See the upstream fix at Kernel Git Commit 49ea8a3 for the corrected ordering, which registers the devm work-cancel callback before devm_request_irq() so the IRQ is freed first.

Detection Methods for CVE-2026-98670

Indicators of Compromise

Kernel oops or panic entries referencing zynq_unmask_work, xilinx-xadc, or iio during driver unbind, module unload, or suspend events.
KASAN reports flagging use-after-free in the xilinx-xadc driver path on ZYNQ hardware.
Repeated bind/unbind cycles of the XADC driver in audit logs on embedded devices.

Detection Strategies

Enable CONFIG_KASAN and CONFIG_DEBUG_OBJECTS in test kernels to surface the use-after-free deterministically.
Inventory ZYNQ-based assets and query running kernel versions to identify systems that lack the stable backports.
Correlate dmesg output across fleet telemetry for the Xilinx XADC driver signature during device lifecycle events.

Monitoring Recommendations

Forward kernel ring buffer and syslog data from embedded ZYNQ devices into a centralized logging pipeline for cross-fleet correlation.
Track module load and unload events (modprobe, rmmod) targeting xilinx-xadc and alert on unexpected activity.
Monitor crash reports and kdump captures for signatures matching the affected worker and IRQ handler symbols.

How to Mitigate CVE-2026-98670

Immediate Actions Required

Apply the upstream patch set to all affected stable kernel branches on ZYNQ platforms.
Restrict driver bind/unbind operations on production devices to administrators and privileged automation only.
Validate kernel images shipped by board support package (BSP) vendors include the backported commits before deployment.

Patch Information

Maintainers merged the fix across multiple stable branches. The corrected driver registers the devm cleanup for the delayed worker before calling devm_request_irq(), ensuring the IRQ is torn down first and no further work can be queued. Review the following commits:

Workarounds

Avoid runtime unbind of the xilinx-xadc driver on affected kernels until the patch is applied.
Disable the XADC driver in the kernel configuration where ADC telemetry is not required on the device.
Blocklist the module through standard distribution mechanisms on systems that cannot be rebuilt immediately.

bash

# Blocklist the xilinx-xadc module until a patched kernel is deployed
echo "blacklist xilinx-xadc" | sudo tee /etc/modprobe.d/cve-2026-98670.conf
sudo depmod -a
sudo update-initramfs -u