In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Use parent device for devres in altr_portb_setup() Anchor the… (CVE-2026-98435)

The vulnerability in the Linux kernel EDAC/altera driver involved improper anchoring of device resource management in the altr_portb_setup() function. Previously, devres groups and devm-managed IRQ requests were tied to an embedded struct device inside a copied per-port altr_edac_device_dev, which could lead to inconsistent resource management. The fix changes this to anchor these resources to the actual parent device (device->edac->dev), ensuring that devres_open_group(), devm_request_irq(), devres_remove_group(), and devres_release_group() all reference the same long-lived device, allowing proper teardown of the resource group and allocated resources.

The vulnerability could cause improper management and teardown of device resources in the affected EDAC/altera driver, potentially leading to resource leaks or instability in the Linux kernel's handling of these devices. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this issue by correctly anchoring device resource management to the parent device. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories for the exact fixed versions and remediation details.