SB20261015117 - Use-after-free in Linux kernel soc samsung driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-98415)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the kernel to access freed memory.

The vulnerability exists due to use-after-free in setup_cpuhp_and_cpuidle() in the Samsung Exynos PMU driver when processing the interrupt generator device tree node. A local user can trigger the affected initialization path to cause the kernel to access freed memory.

The node reference is released after its resource address is retrieved, but the node pointer is subsequently passed to of_syscon_register_regmap().

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/164313e24cb0f51528bc2099c5564174ead11d8a
• https://git.kernel.org/stable/c/4450102d6aa2a85b1d2d8610920fcbe45eb0ef69
• https://git.kernel.org/stable/c/4dd1999783d7d12434006289338373e49492dc96