{"id":"CVE-2026-98938","title":"rust: irq: pass RegistrationInner as cookie to request_irq","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nrust: irq: pass RegistrationInner as cookie to request_irq\n\nWith commit ba268514ea14 (\"rust: devres: fix race condition due to\nnesting\"), Devres::new() returns Result<S…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 29e16fcd67ee5b1d0417a657294cf96fdf2f8df9 < 9a7931e847f338a687e96cde9f37e0cff83ddd84","Linux 6.18"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:11:59.043Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98938","references":[{"url":"https://git.kernel.org/stable/c/9a7931e847f338a687e96cde9f37e0cff83ddd84"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.564Z","slug":"CVE-2026-98938","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nrust: irq: pass RegistrationInner as cookie to request_irq\n\nWith commit ba268514ea14 (\"rust: devres: fix race condition due to\nnesting\"), Devres::new() returns Result<Self> by value instead of\ninitializing in-place via PinInit. Because request_irq() is called\ninside Devres::new(), registration.inner is still uninitialized when the\nIRQ is enabled, so accessing registration.inner.device() in the IRQ\ncallback can read uninitialized memory.\n\nFix this by storing the Device and handler pointer in RegistrationInner\nand passing RegistrationInner as the IRQ cookie after its fields are\ninitialized.\n\nThis is not needed in mainline because commit 98c63ce4d760 (\"rust: irq:\nmake Registration compatible with lifetime-bound drivers\") removed\nDevres from irq::Registration and moved request_irq() after all fields\nare initialized.\n\n## Affected\n\n- `Linux >= 29e16fcd67ee5b1d0417a657294cf96fdf2f8df9 < 9a7931e847f338a687e96cde9f37e0cff83ddd84`\n- `Linux 6.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}