{"id":"CVE-2026-98663","kind":"vulnerability","aliases":["CVE-2026-98663"],"related":[],"title":"Linux kernel: adis16480 debugfs reads can race with driver unbind","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: adis16480: fix unprotected debugfs reads\n\nThe firmware_revision and firmware_date file operations are open coded\nand never call debugfs_file_get(), which debugfs_create_file_unsafe()\nrequires. debugfs_remove_recursive() therefore does not wait for a read\nin progress, and unbind frees the iio_dev underneath it.\n\nUse debugfs_create_file() instead.","summary":"In the Linux IIO adis16480 IMU driver, the firmware_revision and firmware_date debugfs files are read without the protection debugfs requires, so a read in progress can run after the device is freed on unbind. The sources describe a use-after-free on the kernel side; they do not state what an attacker can gain from it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","iio-driver","infrastructure","linux-kernel"],"not_affected_if":["adis16480-not-present","debugfs-not-mounted"],"how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the adis16480 driver is loaded with `lsmod | grep adis16480`\n- unknown for the patched kernel versions","fix":"- Update to a Linux kernel release that includes the upstream commit fixing adis16480 debugfs reads (version unknown from the sources)\n- Use the distribution's kernel update channel","status":"open","published_at":"2026-10-18T16:17:19+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:29+00:00","updated_at":"2026-10-25T05:19:29+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:19:29Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit fixing adis16480 debugfs reads (version unknown from the sources)\n- Use the distribution's kernel update channel","reach":"local","title":"Linux kernel: adis16480 debugfs reads can race with driver unbind","impact":"medium","summary":"In the Linux IIO adis16480 IMU driver, the firmware_revision and firmware_date debugfs files are read without the protection debugfs requires, so a read in progress can run after the device is freed on unbind. The sources describe a use-after-free on the kernel side; they do not state what an attacker can gain from it.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","iio-driver","embedded"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel use-after-free during driver unbind; impact beyond crash unknown","analyst_note":"Confirm the fixed kernel versions and the CVSS/exploitability from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98663 or the upstream stable commit.","how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the adis16480 driver is loaded with `lsmod | grep adis16480`\n- unknown for the patched kernel versions","needs_analyst":true,"not_affected_if":["adis16480-not-present","debugfs-not-mounted"],"who_is_affected":"Systems running a Linux kernel with the adis16480 IIO driver, typically hosts with an ADIS16480-family IMU attached. The sources do not say whether a read can be triggered by an unprivileged user, and debugfs is normally only mounted and readable by root. Systems without this hardware or driver can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000663,"input_tokens":3375,"output_tokens":651,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98663':13A,16A 'adis16480':3A,29B,94C 'attack':79B 'call':112C 'code':109C 'creat':118C,144C 'cve':11A,14A 'date':37B,104C 'debugf':4A,38B,45B,97C,113C,117C,122C,143C 'describ':63B 'dev':139C 'devic':56B 'driver':9A,20B,31B 'embed':17B 'file':39B,105C,114C,119C,145C 'firmwar':33B,36B,100C,103C 'fix':95C 'follow':87C 'free':68B,136C 'freed':58B 'gain':81B 'get':115C 'iio':19B,28B,92C,138C 'iio-driv':18B 'imu':30B,93C 'infrastructur':21B 'instead':146C 'kernel':2A,24B,71B,85C 'linux':1A,23B,27B,84C 'linux-kernel':22B 'never':111C 'open':108C 'oper':106C 'progress':51B,133C 'protect':44B 'race':7A 'read':5A,41B,49B,98C,131C 'recurs':124C 'remov':123C 'requir':46B,121C 'resolv':91C 'revis':34B,101C 'run':53B 'side':72B 'sourc':62B 'state':76B 'therefor':125C 'unbind':10A,60B,135C 'underneath':140C 'unprotect':96C 'unsaf':120C 'use':66B,142C 'use-after-fre':65B 'vulner':88C 'wait':128C 'without':42B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the adis16480 IIO driver, typically hosts with an ADIS16480-family IMU attached. The sources do not say whether a read can be triggered by an unprivileged user, and debugfs is normally only mounted and readable by root. Systems without this hardware or driver can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98663","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98663","severity":null,"published_at":"2026-10-18T16:17:19+00:00","modified_at":"2026-10-21T13:21:35+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}