CVE-2026-98662

iio: light: gp2ap020a00f: drain irq_work after free_irq

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: light: gp2ap020a00f: drain irq_work after free_irq

The threaded IRQ handler queues data->work through irq_work_queue() so the trigger is polled from a per-CPU context. free_irq() does not flush an irq_work the handler already queued, so after gp2ap020a00f_remove() returns that work may still run and call iio_trigger_poll() on data->trig, which the devm cleanup has already freed, causing a use-after-free.

Add irq_work_sync(&data->work) after free_irq() in remove() and in the probe error path, mirroring commit 78601726d4a5 ("iio: trigger: sysfs: fix use-after-free on remove").

Found by an in-house static analysis tool, confirmed by manual review.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	bf29fbeaa13d3350ca71df70c705d8b883c45692 to before 6f2bb000493c3b4f5715b3103657393672aea05bAffected bf29fbeaa13d3350ca71df70c705d8b883c45692 to before 43fbbb9eaae5d6f45668e3c4d45508c498d6ba9cAffected bf29fbeaa13d3350ca71df70c705d8b883c45692 to before d029639b079b28a5334f934c848d895bef0653d1Affected bf29fbeaa13d3350ca71df70c705d8b883c45692 to before 85c20d1cf3f01a506605a16c2f9ce23b9c8b114fAffected bf29fbeaa13d3350ca71df70c705d8b883c45692 to before a36814b9fe00970116d30c3143d81e7425c4d334Affected bf29fbeaa13d3350ca71df70c705d8b883c45692 to before cc71400bc965c0d3894a38ead3d71243400c2d5eAffected bf29fbeaa13d3350ca71df70c705d8b883c45692 to before a1769877ff52a4f1bfb9ca535d1b5113808bd602Affected bf29fbeaa13d3350ca71df70c705d8b883c45692 to before 63213927b141085b6c8719b8037dab3074b7e0feAffected
LinuxLinux	3.13Affected before 3.13Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

bf29fbeaa13d3350ca71df70c705d8b883c45692 to before 6f2bb000493c3b4f5715b3103657393672aea05bAffected
bf29fbeaa13d3350ca71df70c705d8b883c45692 to before 43fbbb9eaae5d6f45668e3c4d45508c498d6ba9cAffected
bf29fbeaa13d3350ca71df70c705d8b883c45692 to before d029639b079b28a5334f934c848d895bef0653d1Affected
bf29fbeaa13d3350ca71df70c705d8b883c45692 to before 85c20d1cf3f01a506605a16c2f9ce23b9c8b114fAffected
bf29fbeaa13d3350ca71df70c705d8b883c45692 to before a36814b9fe00970116d30c3143d81e7425c4d334Affected
bf29fbeaa13d3350ca71df70c705d8b883c45692 to before cc71400bc965c0d3894a38ead3d71243400c2d5eAffected
bf29fbeaa13d3350ca71df70c705d8b883c45692 to before a1769877ff52a4f1bfb9ca535d1b5113808bd602Affected
bf29fbeaa13d3350ca71df70c705d8b883c45692 to before 63213927b141085b6c8719b8037dab3074b7e0feAffected

LinuxLinux

3.13Affected
before 3.13Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.