In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdt_work after releasing the WDT IRQ… (CVE-2026-98496)

The Linux kernel's airoha network driver had a vulnerability where the watchdog IRQ handler could schedule work after the work structure was freed, causing a use-after-free. This occurred because cancel_work_sync() was called after the IRQ was freed, allowing the watchdog interrupt handler to queue work referencing freed memory. The fix was to register the work with devm_work_autocancel before devm_request_irq(), so that the device resource management (devres) framework frees the IRQ before cancelling the work, preventing the race condition and use-after-free. This issue was found during static analysis of kernel code.

The vulnerability could lead to kernel memory corruption due to use-after-free, potentially causing system instability or crashes. No known exploits in the wild have been reported. The impact is limited to the affected driver and kernel versions where this improper resource management occurs.

A fix has been implemented in the Linux kernel source by changing the order of resource management calls to prevent use-after-free. Users should update to a kernel version that includes this fix. No additional mitigation is required if the fixed kernel version is deployed.