{"cve":"CVE-2026-98938","nvd":{"published":"2026-10-23T13:17:14.720","modified":"2026-10-23T13:17:14.720","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrust: irq: pass RegistrationInner as cookie to request_irq\n\nWith commit ba268514ea14 (\"rust: devres: fix race condition due to\nnesting\"), Devres::new() returns Result<Self> by value instead of\ninitializing in-place via PinInit. Because request_irq() is called\ninside Devres::new(), registration.inner is still uninitialized when the\nIRQ is enabled, so accessing registration.inner.device() in the IRQ\ncallback can read uninitialized memory.\n\nFix this by storing the Device and handler pointer in RegistrationInner\nand passing RegistrationInner as the IRQ cookie after its fields are\ninitialized.\n\nThis is not needed in mainline because commit 98c63ce4d760 (\"rust: irq:\nmake Registration compatible with lifetime-bound drivers\") removed\nDevres from irq::Registration and moved request_irq() after all fields\nare initialized.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/9a7931e847f338a687e96cde9f37e0cff83ddd84"],"products":[],"source":"nvd","synced_at":"2026-10-23T16:39:28.036610720+00:00"},"epss":{"cve":"CVE-2026-98938","score":0.00157,"percentile":0.04764,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}