Linux Kernel EUVD-2026-108904

Requires a kernel built with the EDAC/altera driver (CONFIG_EDAC_ALTERA) running on Altera/Intel SoC FPGA hardware. The use-after-free is reachable only in the error path of altr_edac_a10_device_add() or altr_portb_setup(), and only if a managed single- or double-bit ECC IRQ fires in the narrow window after the dci structure is freed but before the managed IRQs are unregistered (AC:H race). Limiting factors: local-only vector (AV:L, not remotely reachable); dependence on this specific, non-default driver and FPGA hardware; and dependence on a probe/setup error actually occurring. The precise mechanism that triggers both the error path and the concurrent IRQ is not described in the available sources.

Signals converge on LOW operational priority despite the 7.4 'High' CVSS. The CVSS vector itself is the dominant limiter: AV:L means no remote reachability, and AC:H reflects a timing race - an ECC IRQ must fire in the narrow window after the dci structure is freed but before the managed IRQ handlers are unregistered. EPSS is 0.21% (10th percentile), consistent with a hardware-specific, hard-to-weaponize memory-safety bug. There is no CISA KEV listing and no public exploit or PoC reference in the input (the git.kernel.org links are fix commits, not exploit code), so this is 'no public exploit identified at time of analysis'. The vuln.today decision label is 'this_week', indicating prompt but non-emergency patching. One conflict to verify: NVD scores PR:N (no privileges), yet the flaw lives in a driver probe/error path and is triggered by ECC interrupt timing on specific FPGA hardware - not an operation an ordinary unprivileged user controls - so the practical privilege/controllability is higher than PR:N implies; verify attacker-reachability with the maintainer. The 'Information Disclosure' tag also understates the C:H/I:H/A:H impact of a kernel use-after-free, which can corrupt memory, not merely leak it.

On an Altera/Intel SoC FPGA system running a kernel with the EDAC/altera driver, the device-add or port-B setup path hits an error and frees the dci structure. Before the managed single/double-bit ECC IRQ handlers are unregistered, an interrupt fires and its handler dereferences altdev(dci->pvt_info), now pointing at freed memory, causing a use-after-free that can corrupt kernel memory or crash the system. No public exploit code exists; exploitation requires the specific hardware and a precisely timed error condition.