CVE-2026-98721 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
The Cadence NAND interrupt handler uses both the IRQ lock and completion object. Registering the IRQ before initializing them leaves a window in which a pending interrupt can access uninitialized synchronization state.
Initialize them before registering the handler.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
This vulnerability represents a classic race condition arising from improper initialization sequencing within the Linux kernel's memory technology device subsystem, specifically affecting the Cadence NAND flash controller driver. The core technical flaw lies in the order of operations during the device probe or interrupt request registration phase. In this scenario, the system registers the hardware interrupt handler with the operating system before ensuring that the internal synchronization primitives required by that handler are fully initialized. These synchronization mechanisms include a spinlock used to protect shared data structures and a completion object utilized for coordinating asynchronous events between the interrupt context and process context. By registering the IRQ first, the kernel exposes a critical window of time where hardware interrupts can be triggered before these vital state variables have been set up with valid values.
The operational impact of this flaw is significant because it creates an opportunity for undefined behavior when a pending or immediate interrupt occurs during this initialization gap. If the Cadence NAND controller asserts its interrupt line while the driver is in the process of setting up, the newly registered handler will execute immediately. Since the IRQ lock and completion object are not yet initialized, any attempt by the handler to acquire the spinlock or signal the completion event may result in accessing memory with garbage values or null pointers. This can lead to kernel panics, system crashes, data corruption within the NAND flash storage, or potentially allow an attacker who has physical access or control over peripheral signals to trigger a denial of service condition by forcing repeated interrupts during this vulnerable window.
From a vulnerability classification perspective, this issue aligns with CWE-362, which describes concurrent execution using shared resources with inadequate synchronization. The lack of proper initialization before resource registration means that the critical section protected by the spinlock is not actually safe from race conditions at startup. Furthermore, in the context of the MITRE ATT&CK framework for enterprise security, this type of flaw can be leveraged to achieve initial code execution or system instability through CWE-479, which refers to a signal handler function that does not safely reenter itself or access uninitialized data. While typically exploited as a local denial-of-service vector due to the kernel-level nature of the bug, it underscores the importance of strict ordering in driver development where hardware events can occur asynchronously at any moment after registration.
To mitigate this vulnerability and prevent similar issues in other drivers, developers must adhere to a rigorous initialization sequence that prioritizes setting up all internal state variables before exposing the device or its interrupt handlers to the kernel's event loop. Specifically for the Cadence NAND driver, the fix involves moving the initialization of the IRQ lock and completion object to precede the call that requests the IRQ from the system. This ensures that when the hardware eventually triggers an interrupt, the handler has access to valid synchronization primitives capable of safely managing concurrent access. System administrators should ensure their kernels are updated with patches addressing this specific ordering issue in the mtd subsystem to maintain stability and security for systems relying on Cadence NAND controllers.