In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to request_irq With commit… (CVE-2026-98938)

The vulnerability in the Linux kernel's Rust IRQ subsystem arose because Devres::new() was changed to return a Result<Self> by value rather than initializing in-place. Since request_irq() was called inside Devres::new(), the registration.inner structure was uninitialized when the IRQ was enabled. Consequently, the IRQ callback could access uninitialized memory via registration.inner.device(). The fix involved storing the Device and handler pointer inside RegistrationInner and passing RegistrationInner as the IRQ cookie only after its fields were fully initialized. This issue is not present in mainline kernels due to a prior commit that removed Devres from irq::Registration and reordered request_irq() after initialization.

The vulnerability could lead to the IRQ callback reading uninitialized memory, which may cause undefined behavior or system instability. There is no information about exploitation in the wild or direct security impact such as privilege escalation or denial of service.

A fix is available and has been applied in the Linux kernel by ensuring RegistrationInner is fully initialized before being passed to request_irq. Users should update to the patched kernel versions containing commit ba268514ea14 or later. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.