SB2026102455 - Use-after-free in Linux kernel edac driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-98740)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service.

The vulnerability exists due to use-after-free in the Altera EDAC ECC setup callbacks and their helpers when device probing executes after initialization memory has been freed. A local privileged user can potentially trigger a deferred probe or a manual device unbind/rebind to invoke functions incorrectly marked __init, potentially crashing the kernel by executing freed memory.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4ec26cb7984740941892ad21fa974963c198bfaa
• https://git.kernel.org/stable/c/9846b85c2eb8b749c3f14bdcc31b1070f6aabba8
• https://git.kernel.org/stable/c/b62a264163ca51bee04785c581344751812395df