CVE-2026-98656

In the Linux kernel, the following vulnerability has been resolved:

iio: trigger: cancel reenable work before freeing trigger

iio trigger notify done atomic() defers ->reenable() into trig->reenable work on the system workqueue, and the worker dereferences the owning trigger through container of(). Nothing cancels this work before iio trig release() frees the trigger, so a worker armed by the last in-flight IRQ can outlive the free and touch freed memory.

Cancel it at the top of iio trig release(), which every free path reaches through the device core's final put device().

Found by an in-house static analysis tool.