CVE-2026-98721: Linux Kernel Race Condition Vulnerability

CVE-2026-98721 Overview

CVE-2026-98721 is a Linux kernel vulnerability in the Cadence raw NAND flash driver (mtd: rawnand: cadence). The driver registers its interrupt handler before initializing the IRQ spinlock and completion object it depends on. A pending interrupt firing in that window can access uninitialized synchronization state, producing undefined kernel behavior.

The issue was resolved upstream by moving initialization of the IRQ lock and completion before request_irq() registration.

Critical Impact
An interrupt delivered during driver probe can touch uninitialized spinlock and completion structures, risking kernel memory corruption, deadlock, or system instability on affected Cadence NAND controllers.

Affected Products

Linux kernel versions containing the Cadence raw NAND driver (drivers/mtd/nand/raw/cadence-nand-controller.c)
Stable kernel branches patched by commits 1ed0ccd5, 21f02701, 24319f25, bbd87eca, and c69d8ace
Embedded and SoC platforms using the Cadence NAND flash controller

Discovery Timeline

2026-10-18 - CVE-2026-98721 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98721

Vulnerability Analysis

The Cadence NAND controller driver uses two synchronization primitives inside its interrupt handler: an IRQ spinlock and a struct completion object. During probe, the driver called request_irq() to register the handler before these primitives were initialized.

If the hardware asserted an interrupt line, or a shared IRQ fired, between request_irq() returning and the subsequent initialization, the handler would operate on uninitialized memory. Taking an uninitialized spinlock or signaling an uninitialized completion can corrupt kernel state, trigger a deadlock, or cause a kernel panic.

This is a classic initialization ordering flaw in driver probe logic, categorized broadly as Uninitialized Memory Use in a race condition context.

Root Cause

The root cause is incorrect ordering of driver setup steps. The handler registration was performed before spin_lock_init() and init_completion() ran against the driver's private state. The fix reorders probe so synchronization primitives are initialized before the IRQ is requested, closing the race window.

Attack Vector

The condition is triggered by interrupt delivery during a narrow probe window. It is not a remotely reachable flaw and requires the Cadence NAND controller to be present and probed. Exploitation potential is limited to local denial of service or kernel instability on affected hardware. No public exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the upstream fixes for implementation detail: Kernel Git Commit 1ed0cc, Kernel Git Commit 21f0270, Kernel Git Commit 24319f2, Kernel Git Commit bbd87ec, and Kernel Git Commit c69d8ac.

Detection Methods for CVE-2026-98721

Indicators of Compromise

Unexpected kernel oops or panic messages referencing cadence_nand_irq or related symbols during boot or module load
Soft lockup or hung task warnings tied to NAND flash I/O early in boot
dmesg entries showing spinlock debugging errors or BUG: spinlock bad magic tied to the Cadence NAND driver

Detection Strategies

Inventory Linux systems running the Cadence NAND controller driver and compare running kernel versions against patched stable branches
Enable CONFIG_DEBUG_SPINLOCK and CONFIG_DEBUG_ATOMIC_SLEEP in test builds to surface uninitialized primitive use
Review boot logs for cadence-nand-controller probe errors or anomalous IRQ handler diagnostics

Monitoring Recommendations

Centralize kernel log collection and alert on panic, oops, or spinlock corruption signatures
Track package and kernel versions across embedded fleets to confirm patch coverage
Monitor for unexpected device reboots or hangs on hardware using Cadence NAND flash

How to Mitigate CVE-2026-98721

Immediate Actions Required

Update affected Linux systems to a kernel build that includes one of the referenced stable commits
For embedded and SoC vendors, rebase board support packages onto patched stable kernels and reissue firmware images
If patching is not immediately possible, restrict unprivileged access to systems to reduce exposure to denial-of-service conditions

Patch Information

The fix moves spin_lock_init() and init_completion() ahead of request_irq() in the Cadence NAND controller probe path. Patched stable commits include 1ed0ccd5, 21f02701, 24319f25, bbd87eca, and c69d8ace. Apply the version matching your stable branch and rebuild the kernel or install the vendor-supplied package.

Workarounds

Disable the cadence-nand-controller driver on systems that do not require NAND flash support
Blacklist the module via /etc/modprobe.d/ where the controller is not in active use
Delay or gate device enablement until the kernel has fully initialized if the platform supports deferred probe

bash

# Blacklist the Cadence NAND controller module where not required
echo "blacklist cadence_nand_controller" | sudo tee /etc/modprobe.d/blacklist-cadence-nand.conf
sudo update-initramfs -u