CVE-2026-98677
Received Received - Intake

Use-After-Free in Linux Kernel IIO ADC Sigma Delta Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta: fix use-after-free on unbind ad_sd_buffer_postenable() allocates sigma_delta->samples_buf with devm_krealloc() at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources are released in reverse allocation order, which means unbind frees samples_buf before iio_device_unregister() disables the buffers and detaches the trigger pollfunc. The data ready IRQ is still enabled at that point, so ad_sd_trigger_handler() can still run and memcpy() incoming samples into the freed samples_buf. Fix this by preallocating the buffer in devm_ad_sd_setup_buffer_and_trigger(), before the triggered buffer and the IRQ are set up, so it is freed only after iio_device_unregister() has drained the trigger handler via free_irq(). Size it for the worst case of all sequencer slots being active; ad_sd_validate_scan_mask() already caps the number of active channels at num_slots. This issue was found by an in-house static analysis tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98677
EUVD
EUVD-2026-103931

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 8bea9af887de4c99a95f93f2ce400ef63e8b4e9b
Linux Linux 8bea9af887de4c99a95f93f2ce400ef63e8b4e9b
Linux Linux 8bea9af887de4c99a95f93f2ce400ef63e8b4e9b
Linux Linux 8bea9af887de4c99a95f93f2ce400ef63e8b4e9b
Linux Linux 5.19

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's IIO ADC subsystem. It occurs when unbinding a driver, where a buffer allocated at runtime is freed before the device's buffers and triggers are properly disabled. This allows an interrupt handler to still write data to the freed memory, potentially causing crashes or other undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's IIO ADC subsystem and requires kernel-level inspection. Detection involves checking for use-after-free conditions in the ad_sigma_delta driver. No direct network detection commands exist; instead, monitor kernel logs for crashes or memory corruption related to IIO ADC drivers.

Impact Analysis

This vulnerability could lead to system instability, crashes, or potential privilege escalation if exploited. It specifically affects systems using the IIO ADC subsystem with certain drivers, potentially causing data corruption or denial of service.

Mitigation Strategies

Apply the kernel patch that reorders resource allocation to prevent use-after-free. Update to a Linux kernel version containing the fix. If immediate patching is not possible, disable affected IIO ADC drivers or devices until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98677. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart