CVE-2026-98496

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: npu: cancel wdt work after releasing the WDT IRQ

airoha npu remove() calls cancel work sync() on each core's wdt work, but the watchdog IRQ that queues it is requested with devm request irq() and is freed only after .remove() returns. airoha npu wdt handler() can therefore schedule work() again once the cancel has returned. struct airoha npu, which contains the work, is devm kzalloc()'d and is freed in that same unwind, so the late work dereferences freed memory.

Register the work with devm work autocancel() before devm request irq() and drop .remove(). Devres runs in reverse order, so the IRQ is freed before cancel work sync(), including when probe fails. A cancel left in .remove() cannot get that order. Initializing the work first also stops a pending watchdog interrupt from queuing an uninitialized work item. Probe currently calls INIT WORK() only after devm request irq().

This issue was identified during our ongoing static-analysis research while reviewing kernel code.