CVE-2026-98740 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
EDAC/altera: Drop __init from ECC setup paths for re-probe safety
Sashiko reports:
"Does suppressing sysfs unbinding fully prevent the execution of freed __init memory? If altr_sysmgr_regmap_lookup_by_phandle() returns -EPROBE_DEFER, the probe is deferred until after __init memory is freed."
The a10 EDAC .setup callbacks (sdmmc, ethernet, nand, dma, usb, qspi) and their helpers (altr_init_a10_ecc_device_type, altr_init_a10_ecc_block) were marked __init. These run from the probe path, which may execute after init memory is freed -- e.g. a probe deferred via -EPROBE_DEFER that only succeeds once a late/module dependency appears, or a manual unbind/rebind. Calling __init code then dereferences freed memory. Remove __init so these functions remain valid at runtime.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in the Linux kernel's EDAC Altera subsystem stems from an incorrect usage of initialization section markers on driver probe callbacks, specifically within the a10 ECC setup paths for peripherals such as sdmmc, ethernet, nand, dma, usb, and qspi. The core technical flaw lies in marking functions like altr_init_a10_ecc_device_type and altr_init_a10_ecc_block with the __init attribute. In Linux kernel development, code marked with __init is intended to be executed only during the initial boot process when drivers are probed for the first time. Once this phase completes, the memory occupied by these functions is freed to reclaim resources for other critical system operations. However, the probe mechanism in modern kernels supports deferred probing via -EPROBE_DEFER errors, which occur when a driver's dependencies are not yet available. If such a dependency becomes available later during runtime, or if an administrator manually triggers a rebind operation through sysfs unbinding and rebinding, the kernel may attempt to execute these probe callbacks after the initial boot sequence has finished.
This timing mismatch creates a critical memory safety issue where the kernel attempts to dereference freed memory. When the deferred probe finally succeeds or when a manual reprobe is initiated, the system calls into functions that reside in the now-freed __init section. This results in undefined behavior, typically manifesting as a kernel panic, oops, or data corruption due to accessing invalid memory addresses. The issue highlights a common misconception regarding the scope of initialization code; while it optimizes boot-time memory usage, it assumes drivers are never probed after the initmem is released. In complex embedded systems like those using Altera architectures, where hardware dependencies can be intricate and timing-sensitive, this assumption often fails, leading to stability issues that compromise system reliability.
From a security perspective, dereferencing freed kernel memory falls under CWE-416 Use After Free, which allows for potential denial of service through system crashes. In more severe scenarios, if the attacker or malicious process can influence the timing of probe deferrals or trigger manual rebinds in specific contexts, this could potentially lead to arbitrary code execution by overwriting freed memory structures before they are reallocated for other purposes. This aligns with ATT&CK techniques related to system exploitation and privilege escalation via kernel vulnerabilities. The operational impact is primarily a denial of service due to the instability introduced into the device driver subsystem, but it also represents a significant attack surface within the kernel's core infrastructure.
To mitigate this vulnerability, the primary remediation involves removing the __init attribute from the affected setup callbacks and their helper functions in the EDAC Altera driver code. By ensuring these functions remain resident in memory throughout the system's runtime, they can be safely invoked during deferred probes or manual rebind operations without risking access to freed memory regions. This change increases the kernel's static memory footprint slightly but ensures robustness against timing-dependent probe failures and dynamic device management scenarios. Developers should audit other drivers for similar patterns where __init is applied to functions that might be called outside of the initial boot phase, particularly in subsystems handling hardware dependencies or power state transitions. Regular code reviews focusing on lifecycle management of driver components are essential to prevent such initialization-related memory safety violations.