In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap020a00f: drain irq_work after free_irq The threaded IRQ handler… (CVE-2026-98662)

The Linux kernel's iio light sensor driver gp2ap020a00f had a use-after-free vulnerability caused by the threaded IRQ handler queuing work via irq_work_queue() without flushing it on free_irq(). After gp2ap020a00f_remove() returns, the queued work could still run and call iio_trigger_poll() on a trigger that has already been freed by devm cleanup, leading to use-after-free. The fix adds irq_work_sync(&data->work) after free_irq() in the remove function and probe error path, ensuring the queued work is completed before the trigger is freed. This vulnerability was found by an in-house static analysis tool and confirmed manually.

The vulnerability allows a use-after-free condition in kernel space, which can lead to undefined behavior including potential kernel crashes or memory corruption. No known exploits in the wild have been reported. The impact is limited to systems using the affected iio light sensor driver.

A fix is available that adds synchronization to drain queued irq_work after free_irq() calls in the gp2ap020a00f driver. Users should apply the updated Linux kernel version containing this fix. No additional mitigation is required beyond applying the official patch.