Use-After-Free Vulnerability in Samsung Exynos PMU Device

CVE-2026-98415

What is CVE-2026-98415?

A vulnerability in the Linux kernel's handling of the Samsung Exynos Power Management Unit (PMU) can lead to a use-after-free condition. This issue arises when the setup_cpuhp_and_cpuidle() function incorrectly manages reference counts of the interrupt generation block's device tree node. Specifically, after fetching the resource address, the node's reference count is decremented too early, which might allow for unintended access to freed memory. This flaw could potentially be exploited by an attacker to execute arbitrary code or cause system instability.

References