CVE-2026-98664
Received Received - Intake

Unprotected Debugfs Reads in Linux Kernel IIO IMU Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprotected debugfs reads adis16400_serial_number_fops is open coded and never calls debugfs_file_get(), so debugfs_remove_recursive() does not wait for a read in progress and unbind frees the iio_dev underneath it. Commit ae1d37a9bb4b ("iio: imu: adis16400: use DEFINE_DEBUGFS_ATTRIBUTE instead of DEFINE_SIMPLE_ATTRIBUTE") converted product_id and flash_count to DEFINE_DEBUGFS_ATTRIBUTE, which protects itself, but moved all three files to debugfs_create_file_unsafe(). serial_number prints three registers as "%.4x-%.4x-%.4x" and DEFINE_DEBUGFS_ATTRIBUTE() formats a single u64, so it cannot be converted without changing what the file returns. adis16475 and adis16550 already use debugfs_create_file() for their open coded files. Use it here too.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98664
EUVD
EUVD-2026-103918

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux ae1d37a9bb4bd8d9091a40d153143e99b115ee37
Linux Linux ae1d37a9bb4bd8d9091a40d153143e99b115ee37
Linux Linux ae1d37a9bb4bd8d9091a40d153143e99b115ee37
Linux Linux ae1d37a9bb4bd8d9091a40d153143e99b115ee37
Linux Linux 5.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of debugfs file operations in the adis16400 IIO IMU driver. The issue occurs because the serial_number debugfs file was not protected with debugfs_file_get(), allowing debugfs_remove_recursive() to remove the file while a read operation is still in progress. This can lead to a use-after-free scenario where the iio_dev structure is freed while a read is ongoing.

Detection Guidance

This vulnerability is specific to the Linux kernel's IIO IMU subsystem, particularly the adis16400 driver. Detection requires checking the kernel version and the presence of vulnerable code. Use uname -a to check the kernel version and grep for the affected driver in /lib/modules/$(uname -r)/kernel/drivers/iio/imu/adis16400. If the driver is loaded, inspect debugfs entries under /sys/kernel/debug/iio/device*/serial_number for improper access patterns.

Impact Analysis

This vulnerability could cause system instability or crashes if an attacker exploits it to trigger a use-after-free condition. It may lead to denial-of-service (DoS) attacks or potentially allow privilege escalation if combined with other vulnerabilities. Systems using affected Linux kernel versions with the adis16400 driver are at risk.

Mitigation Strategies

Update the Linux kernel to a version containing the fix (commit ae1d37a9bb4b or later). If immediate update is not possible, disable the adis16400 driver by blacklisting it via modprobe.conf or removing the module with rmmod. Monitor for crashes or debugfs access errors in system logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98664. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart