---
id: CVE-2026-98496
title: 'net: airoha: npu: cancel wdt_work after releasing the WDT IRQ'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: airoha: npu: cancel wdt_work after releasing the WDT IRQ

  airoha_npu_remove() calls cancel_work_sync() on each core's wdt_work,
  but the watchdog IRQ that queues it…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 23290c7bc190def4e1ca61610992d9b7c32e33f3 <
    aca91d8fa0ecbc990ebf9a688c684dda78a43c00
  - >-
    Linux >= 23290c7bc190def4e1ca61610992d9b7c32e33f3 <
    da9d42531f3a6dfea2e9c775b62a46185dbf280a
  - >-
    Linux >= 23290c7bc190def4e1ca61610992d9b7c32e33f3 <
    4bdee8060d1e4581624e68fbd369b1afb14df4bc
  - Linux 6.15
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:16:27.545Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98496'
references:
  - url: 'https://git.kernel.org/stable/c/aca91d8fa0ecbc990ebf9a688c684dda78a43c00'
  - url: 'https://git.kernel.org/stable/c/da9d42531f3a6dfea2e9c775b62a46185dbf280a'
  - url: 'https://git.kernel.org/stable/c/4bdee8060d1e4581624e68fbd369b1afb14df4bc'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.291Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: npu: cancel wdt_work after releasing the WDT IRQ

airoha_npu_remove() calls cancel_work_sync() on each core's wdt_work,
but the watchdog IRQ that queues it is requested with devm_request_irq()
and is freed only after .remove() returns.  airoha_npu_wdt_handler() can
therefore schedule_work() again once the cancel has returned.  struct
airoha_npu, which contains the work, is devm_kzalloc()'d and is freed in
that same unwind, so the late work dereferences freed memory.

Register the work with devm_work_autocancel() before devm_request_irq()
and drop .remove().  Devres runs in reverse order, so the IRQ is freed
before cancel_work_sync(), including when probe fails.  A cancel left in
.remove() cannot get that order.  Initializing the work first also stops
a pending watchdog interrupt from queuing an uninitialized work item.
Probe currently calls INIT_WORK() only after devm_request_irq().

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

## Affected

- `Linux >= 23290c7bc190def4e1ca61610992d9b7c32e33f3 < aca91d8fa0ecbc990ebf9a688c684dda78a43c00`
- `Linux >= 23290c7bc190def4e1ca61610992d9b7c32e33f3 < da9d42531f3a6dfea2e9c775b62a46185dbf280a`
- `Linux >= 23290c7bc190def4e1ca61610992d9b7c32e33f3 < 4bdee8060d1e4581624e68fbd369b1afb14df4bc`
- `Linux 6.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.