CVE-2026-98662 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of affected Linux kernel versions should review and apply the patch to affected versions. Linux distribution maintainers should update their packages to include the fix. Users of affected Linux kernel versions should update their systems to a version that includes the fix. System administrators and security teams should monitor system logs for potential crashes or errors and

Why it matters

This vulnerability can cause a system crash or potentially allow an attacker to execute arbitrary code. Linux kernel developers and maintainers should review and apply the patch to affected versions. Linux distribution maintainers should update their packages to include the fix. Users of affected Linux kernel versions should update their systems to a version that includes the fix.

• Potential system crash or instability
• Possible execution of arbitrary code

Technical summary

The Linux kernel's iio: light: gp2ap020a00f driver is vulnerable to a use-after-free issue. The threaded IRQ handler queues data->work through irq_work_queue(), which can lead to a use-after-free when gp2ap020a00f_remove() returns and the devm cleanup has already freed the data->trig. This issue can cause a system crash or potentially allow an attacker to execute arbitrary code. The fix involves adding irq_work_sync(&data->work) after free_irq() in remove() and in the probe error path, mirroring commit 78601726d4a5 (iio: trigger: sysfs: fix use-after-free on remove).

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to the affected Linux kernel versions
• Update the Linux kernel to a version that includes the fix
• Monitor system logs for potential crashes or errors related to the iio: light: gp2ap020a00f driver
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was found by an in-house static analysis tool and confirmed by manual review. The issue is resolved by adding irq_work_sync(&data->work) after free_irq() in remove() and in the probe error path.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.