In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind… (CVE-2026-98670)

The Linux kernel's iio adc xilinx-xadc driver had a flaw where the IRQ handler could queue delayed work after the xadc structure was freed during device unbind. The fix involved registering the devm callback that frees the IRQ before requesting the IRQ, ensuring the IRQ is freed first during teardown. This prevents the handler from re-arming work after the workqueue is cleared, eliminating a potential use-after-free scenario. The issue was identified via an in-house static analysis tool.

If unpatched, the vulnerability could allow the IRQ handler to queue work referencing freed memory, potentially leading to use-after-free conditions. This could cause kernel instability or crashes. No direct exploit or active attacks are reported.

A fix is available in the Linux kernel that changes the order of resource teardown to free the IRQ before cancelling the unmask worker. Users should update to the fixed kernel version containing this patch. No additional mitigation is indicated.