CVE-2026-98496 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems that use the airoha NPU driver. Linux kernel developers, maintainers, and users of Linux-based systems that use this driver should assess exposure and verify patch application. This includes anyone responsible for maintaining or securing Linux-based systems that utilize the airoha NPU driver, as well as those involved in vulnerability management and IT

Why it matters

The Linux kernel vulnerability in the airoha NPU driver can cause system crashes or potentially allow attackers to execute arbitrary code. Linux kernel developers, maintainers, and users of Linux-based systems that use this driver should assess exposure and verify patch application.

• Potential system crashes or instability
• Possible code execution or privilege escalation
• Increased attack surface for Linux kernel vulnerabilities
• Verification of patch application and system stability required

Technical summary

The airoha_npu_remove function calls cancel_work_sync on each core's wdt_work, but the watchdog IRQ that queues it is requested with devm_request_irq and is freed only after .remove returns. This can cause a use-after-free condition when the watchdog IRQ is triggered after the work has been cancelled. The vulnerability was identified during static analysis of the Linux kernel code, and the issue is caused by the airoha_npu_remove function calling cancel_work_sync on each core's wdt_work, but the watchdog IRQ that queues it is requested with devm_request_irq and is freed only after .remove returns. Register the work with devm_work_autocancel() before devm_request_irq() and drop .remove().

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to the airoha NPU driver
• Verify that the Linux kernel is up-to-date
• Monitor system logs for potential crashes or errors
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The vulnerability was identified during static analysis of the Linux kernel code. The issue is caused by the airoha_npu_remove function calling cancel_work_sync on each core's wdt_work, but the watchdog IRQ that queues it is requested with devm_request_irq and is freed only after .remove returns.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.