SB20261022244 - Use-after-free in Linux kernel iio proximity driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261022244

SB20261022244 - Use-after-free in Linux kernel iio proximity driver

Published: October 22, 2026

Security Bulletin ID SB20261022244
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use-after-free (CVE-ID: CVE-2026-98657)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to potentially cause a denial of service by accessing freed kernel memory.

The vulnerability exists due to a use-after-free in the Linux kernel pulsedlight proximity driver when runtime power management setup fails during device probing. The error handling frees the device structure without unregistering the IIO device, leaving live sysfs and character device nodes pointing to freed memory. A local user can access these stale device nodes to potentially trigger a kernel crash.


Remediation

Install update from vendor's website.

References