In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenable_work before freeing trigger… (CVE-2026-98656)

The vulnerability in the Linux kernel's iio trigger subsystem arises because the function iio_trigger_notify_done_atomic() defers a reenable operation into trig->reenable_work on the system workqueue. This deferred work references the owning trigger via container_of(). However, no cancellation of this work occurs before iio_trig_release() frees the trigger, allowing a worker task triggered by the last in-flight IRQ to access freed memory, leading to a use-after-free condition. The fix involves canceling the reenable_work at the start of iio_trig_release(), which is reached through the device core's final put_device() call, preventing the worker from accessing freed memory. This vulnerability was identified by an in-house static analysis tool.

This vulnerability could lead to use-after-free conditions in the Linux kernel, potentially causing system instability, crashes, or undefined behavior. There is no indication of known exploits in the wild. The impact is limited to kernel stability and reliability rather than direct privilege escalation or remote code execution based on the provided data.

A fix has been implemented that cancels the deferred reenable_work before freeing the trigger in the iio subsystem. Users should apply the official kernel update that includes this fix once available. Since this is a kernel-level issue, updating to the patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor or kernel mailing list advisories for the current remediation status and available updates.