CVE-2026-98435 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
EDAC/altera: Use parent device for devres in altr_portb_setup()
Anchor the devres group and the devm-managed IRQ requests in altr_portb_setup() to the actual parent device (device->edac->dev) instead of the embedded struct device inside the copied per-port altr_edac_device_dev.
This keeps devres_open_group(), devm_request_irq(), devres_remove_group() and devres_release_group() all referring to the same long-lived device so the group and the resources allocated inside it are torn down together.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability addressed in this update pertains to a resource management flaw within the Linux kernel's Error Detection And Correction (EDAC) subsystem, specifically affecting the Altera memory controller driver. The core issue lies in how device resources and interrupt requests were anchored during the initialization of port B setup functions. Previously, the devres group and managed IRQ requests were tied to an embedded struct device contained within a copied per-port structure rather than the actual parent device representing the hardware component. This architectural misalignment created a discrepancy between the lifecycle of the allocated resources and the lifecycle of the primary device object that manages them.
From a technical perspective, this flaw represents a classic case of improper resource anchoring which can lead to use-after-free conditions or memory leaks depending on the timing of driver unbinding versus hardware removal. By using devm_request_irq and related functions anchored to an embedded copy instead of the parent device, the kernel's managed resource framework could fail to correctly track these allocations against the correct entity. Consequently, when the parent device was released or reset, the resources allocated for the specific port might not be properly cleaned up because they were associated with a transient or secondary structure that did not share the same lifecycle as the main driver instance. This misalignment violates the principle of consistent resource ownership expected by the kernel's devres subsystem.
The operational impact of this vulnerability includes potential system instability, memory leaks, and undefined behavior during device removal or error handling sequences. If the embedded struct is freed while IRQs are still active or if the parent device expects resources to be present that were anchored elsewhere, it can lead to crashes or degraded performance over time as leaked kernel memory accumulates. In critical infrastructure environments relying on EDAC for hardware health monitoring, such instability could obscure real hardware errors or cause false positives due to driver state corruption.
This issue is categorized under CWE-401: Missing Release of Memory after Effective Lifetime and CWE-755: Improper Handling of Unexpected Condition in Error Handling Paths within the Common Weakness Enumeration framework. It also aligns with ATT&CK technique T1068, which involves exploitation techniques related to privilege escalation through kernel vulnerabilities, although this specific instance is primarily a stability issue rather than an exploitable security flaw for remote code execution. The fix ensures that devres_open_group, devm_request_irq, devres_remove_group, and devres_release_group all operate on the same long-lived parent device object. This correction guarantees that resources are allocated and released in unison with the primary driver instance, maintaining system integrity and preventing resource leaks during normal operation or error recovery scenarios.