CVE-2026-98721

Low risk· EPSS 10%

Published: 18/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 18/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

In the Linux kernel's Cadence NAND driver (mtd: rawnand), the interrupt handler is registered before the IRQ lock and completion object are initialized. This leaves a window where a pending interrupt can access uninitialized synchronization state.

Risk Assessment

This can lead to a race condition and use of uninitialized data, causing system instability, kernel crashes, or potential security issues on devices with the Cadence NAND controller.

Recommendation

Update the Linux kernel to a version containing the fix that initializes the IRQ lock and completion object before registering the interrupt handler.

Other vulnerabilities in Linux kernel (mtd rawnand cadence)

CVE-2025-68238Low risk· EPSS 8%
In the Linux kernel, the mtd rawnand cadence driver dereferenced the DMA device pointer dma_dev before ensuring cdns_ctrl->dmac was properly initialized. The fix moves the assignment of dma_dev after successfully acquiring the DMA channel.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ The Cadence NAND interrupt handler uses both the IRQ lock and completion object. Registering the IRQ before initializing them leaves a window in which a pending interrupt can access uninitialized synchronization state. Initialize them before registering the handler.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS