---
id: CVE-2026-97600
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ieee802154: cc2520: fix FIFOP work use-after-free

  The FIFOP interrupt handler queues cc2520_fifop_irqwork
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ieee802154: cc2520: fix FIFOP work use-after-free

  The FIFOP interrupt handler queues cc2520_fifop_irqwork.  On removal,
  cc2520_remove() only flushes the work.  The dev…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0da6bc8cc3417a5e452efb886ff2c61e72b743d6 <
    56a9919d8494fb118eebf167bef0622528fbf2e7
  - >-
    Linux >= 0da6bc8cc3417a5e452efb886ff2c61e72b743d6 <
    c68fd52c73b676aee67020011e98fea125a978f4
  - >-
    Linux >= 0da6bc8cc3417a5e452efb886ff2c61e72b743d6 <
    890a80d516a1447db5c21bf92841a82914ea897d
  - >-
    Linux >= 0da6bc8cc3417a5e452efb886ff2c61e72b743d6 <
    ff5891b266a7fc6a062710836be84f1cc19338b5
  - Linux 3.17
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:11.353'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97600'
references:
  - url: 'https://git.kernel.org/stable/c/56a9919d8494fb118eebf167bef0622528fbf2e7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/890a80d516a1447db5c21bf92841a82914ea897d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c68fd52c73b676aee67020011e98fea125a978f4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ff5891b266a7fc6a062710836be84f1cc19338b5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.904Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: cc2520: fix FIFOP work use-after-free

The FIFOP interrupt handler queues cc2520_fifop_irqwork.  On removal,
cc2520_remove() only flushes the work.  The devm-managed FIFOP IRQ
remains active until after ->remove() returns and can queue the work
again after that flush, allowing it to run after the private data is
released.

Disable the work with disable_work_sync() instead of flushing it, so
the handler can no longer queue it once removal begins.  Destroy the
buffer mutex last, since the worker and the stop callback invoked
through ieee802154_unregister_hw() both take it.

Found by an in-house static analysis tool.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.