CVE-2026-98938

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to request_irq With commit ba268514ea14 ("rust: devres: fix race condition due to nesting"), Devres::new() returns Result<Self> by value instead of initializing in-place via PinInit. Because request_irq() is called inside Devres::new(), registration.inner is still uninitialized when the IRQ is enabled, so accessing registration.inner.device() in the IRQ callback can read uninitialized memory. Fix this by storing the Device and handler pointer in RegistrationInner and passing RegistrationInner as the IRQ cookie after its fields are initialized. This is not needed in mainline because commit 98c63ce4d760 ("rust: irq: make Registration compatible with lifetime-bound drivers") removed Devres from irq::Registration and moved request_irq() after all fields are initialized.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-10-23 13:17:14.720000

Last modified

2026-10-23 13:17:14.720000

View original CVE JSON

{
  "id": "CVE-2026-98938",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-10-23T13:17:14.720",
  "lastModified": "2026-10-23T13:17:14.720",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust: irq: pass RegistrationInner as cookie to request_irq\n\nWith commit ba268514ea14 (\"rust: devres: fix race condition due to\nnesting\"), Devres::new() returns Result<Self> by value instead of\ninitializing in-place via PinInit. Because request_irq() is called\ninside Devres::new(), registration.inner is still uninitialized when the\nIRQ is enabled, so accessing registration.inner.device() in the IRQ\ncallback can read uninitialized memory.\n\nFix this by storing the Device and handler pointer in RegistrationInner\nand passing RegistrationInner as the IRQ cookie after its fields are\ninitialized.\n\nThis is not needed in mainline because commit 98c63ce4d760 (\"rust: irq:\nmake Registration compatible with lifetime-bound drivers\") removed\nDevres from irq::Registration and moved request_irq() after all fields\nare initialized."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "rust/kernel/irq/request.rs"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "29e16fcd67ee5b1d0417a657294cf96fdf2f8df9",
              "lessThan": "9a7931e847f338a687e96cde9f37e0cff83ddd84",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "rust/kernel/irq/request.rs"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.18",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.18",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.10",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/9a7931e847f338a687e96cde9f37e0cff83ddd84",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}