CVE-2026-98280

CVE-2026-98280

published October 6, 2026

CVSS
—
EPSS
0%
Percentile
5.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/i2c: Disable IRQ on unbind

Currently, struct xe_i2c is freed before SGUnit IRQ is disabled in unbind

path, leaving a potential UAF in case I2C IRQ is hit during this small

window. Explicitly disable I2C IRQ in xe_i2c_remove() and fix this.

(cherry picked from commit 8ba5c8b8ab3fd362267c11df2cd5a90ee46f6e24)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.1th percentile
Published
2026-10-06T13:18Z
References (2)
https://git.kernel.org/stable/c/571ccbc801aa4d22a22d9f924b826c77052330f0 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f0e9f963a3d209d7dc7ddd61116118ab5da2797d · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 07 OCT 03:43Z
    EPSS moved — → 0%
    epss
  • 06 OCT 08:45Z
    drm/xe/i2c: Disable IRQ on unbind
    cvelistv5