SB2026102269 - Use of uninitialized resource in Linux kernel ethernet airoha driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use of uninitialized resource (CVE-ID: CVE-2026-98496)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through use of an uninitialized kernel work item.

The vulnerability exists due to use of an uninitialized resource in the Airoha NPU driver's probe routine when the watchdog interrupt is registered before its work item is initialized. A local privileged user can exploit a pending watchdog interrupt during this initialization window to queue an uninitialized work item and potentially cause a kernel crash.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4bdee8060d1e4581624e68fbd369b1afb14df4bc
• https://git.kernel.org/stable/c/aca91d8fa0ecbc990ebf9a688c684dda78a43c00
• https://git.kernel.org/stable/c/da9d42531f3a6dfea2e9c775b62a46185dbf280a