CVE-2026-53386

Received Received - Intake

Buffer Overflow in Linux Kernel TI ADS1298 ADC Driver

Publication date: 2026-07-19

Last updated on: 2026-07-20

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: add bounds check to pga_settings index ads1298_pga_settings has 7 elements but ADS1298_MASK_CH_PGA can yield values 0-7. If it yields a value >= 7, this causes an out-of-bounds array access. Add a bounds check and return -EINVAL if the index is out of range. Note that the remaining value b111 is reserved so should not be seen in a correctly functioning system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-07-20

Generated

2026-07-20

AI Q&A

2026-07-19

EPSS Evaluated

N/A

NVD

CVE-2026-53386

EUVD

EUVD-2026-45508

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel related to the TI ADS1298 analog-to-digital converter driver. The issue involves an out-of-bounds array access in the ads1298_pga_settings array. The array has 7 elements, but the ADS1298_MASK_CH_PGA value can range from 0 to 7. When the value is 7 or higher, it causes an out-of-bounds access, potentially leading to memory corruption or system instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's ti-ads1298 driver and involves an out-of-bounds array access. Detection requires checking kernel logs for errors related to ads1298_pga_settings or ADS1298_MASK_CH_PGA. Use commands like dmesg | grep -i ads1298 or journalctl -k | grep -i ads1298 to search for relevant errors.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger an out-of-bounds memory access, potentially causing system crashes, data corruption, or privilege escalation. It may also lead to denial-of-service conditions if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a low-level kernel issue involving an out-of-bounds array access in the TI ADS1298 ADC driver, which could lead to undefined behavior or crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the bounds check for ads1298_pga_settings. Monitor kernel updates from your distribution and apply them promptly. If immediate patching is not possible, restrict access to systems using the ti-ads1298 driver until patched.

Hi! I’m here to help you understand CVE-2026-53386. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70