In the Linux kernel, the following vulnerability has been resolved:

iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind

The ZYNQ XADC alarm IRQ handler queues zynq unmask work via schedule delayed work(); that work is cleared by a devm callback. Register the devm callback before devm request irq() so the devres LIFO teardown frees the IRQ first, ensuring the handler can no longer queue work by the time the workqueue is cleared. Otherwise the handler could re-arm the work and run it after the xadc structure has been freed.

This issue was found by an in-house static analysis tool.