CVE-2026-98938 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
rust: irq: pass RegistrationInner as cookie to request_irq
With commit ba268514ea14 ("rust: devres: fix race condition due to nesting"), Devres::new() returns Result<Self> by value instead of initializing in-place via PinInit. Because request_irq() is called inside Devres::new(), registration.inner is still uninitialized when the IRQ is enabled, so accessing registration.inner.device() in the IRQ callback can read uninitialized memory.
Fix this by storing the Device and handler pointer in RegistrationInner and passing RegistrationInner as the IRQ cookie after its fields are initialized.
This is not needed in mainline because commit 98c63ce4d760 ("rust: irq: make Registration compatible with lifetime-bound drivers") removed Devres from irq::Registration and moved request_irq() after all fields are initialized.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The identified vulnerability resides within the Linux kernel's Rust subsystem, specifically affecting the interrupt handling mechanism during device resource management initialization. The root cause is a race condition stemming from an incorrect implementation of object construction in Devres::new(). In this flawed sequence, the function returns Result<Self> by value rather than initializing the struct fields in-place via PinInit. Consequently, when request_irq() is invoked within the constructor body, the internal state registration.inner remains uninitialized at that moment. This premature invocation means that if an interrupt occurs immediately upon enabling it, the associated callback attempts to access registration.inner.device(), which results in reading from uninitialized memory locations.
This flaw represents a classic instance of use-before-initialization, where code executes operations on data structures before they have been properly set up with valid values. The operational impact is severe, as accessing uninitialized memory can lead to unpredictable behavior including kernel panics, information disclosure through leaked stack or heap contents, or potential privilege escalation if an attacker can control the uninitialized memory content and trigger specific execution paths. Such vulnerabilities undermine system stability and security by introducing undefined behavior into critical low-level subsystems that manage hardware interrupts.
From a classification perspective, this issue aligns with CWE-908, which denotes use of uninitialized resource, as well as CWE-672 regarding the use of externally-controlled pointers without proper validation or initialization context. In terms of attack vectors and techniques, it relates to MITRE ATT&CK tactics involving execution phase exploitation where attackers might leverage memory corruption primitives to gain control flow hijacking capabilities. The vulnerability highlights the complexities involved in integrating safe systems programming languages like Rust into kernel space while maintaining compatibility with existing C-based resource management paradigms.
The resolution involves restructuring the initialization sequence for irq::Registration by storing both the Device reference and handler pointer directly within RegistrationInner before any interrupt registration occurs. By passing RegistrationInner as the cookie to request_irq only after all fields are fully initialized, the race condition is eliminated ensuring that subsequent callbacks always operate on valid, properly constructed data structures. This fix ensures memory safety guarantees provided by Rust remain intact even under concurrent execution scenarios typical in high-load kernel environments.
It is important to note that this specific vulnerability does not affect mainline kernels due to prior architectural changes. Commit 98c63ce4d760 reworked irq::Registration to be compatible with lifetime-bound drivers, effectively removing the dependency on Devres for interrupt registration and moving request_irq() calls to occur after all struct fields are initialized. This demonstrates how iterative improvements in kernel design can preemptively address subtle concurrency bugs that arise from complex initialization sequences. System administrators should ensure their kernels incorporate these upstream fixes or apply equivalent patches if running older versions where this race condition remains present.