Use of uninitialized resource in Linux kernel - CVE-2026-98496

Vulnerability identifier: #VU156797

CSH Severity: Low

CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98496

CWE-ID: CWE-908

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local privileged user to potentially cause a denial of service through use of an uninitialized kernel work item.

The vulnerability exists due to use of an uninitialized resource in the Airoha NPU driver's probe routine when the watchdog interrupt is registered before its work item is initialized. A local privileged user can exploit a pending watchdog interrupt during this initialization window to queue an uninitialized work item and potentially cause a kernel crash.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/4bdee8060d1e4581624e68fbd369b1afb14df4bc
• https://git.kernel.org/stable/c/aca91d8fa0ecbc990ebf9a688c684dda78a43c00
• https://git.kernel.org/stable/c/da9d42531f3a6dfea2e9c775b62a46185dbf280a

• Use of uninitialized resource in Linux kernel ethernet airoha driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more