{"id":"CVE-2026-98664","kind":"vulnerability","aliases":["CVE-2026-98664"],"related":[],"title":"Linux kernel: IIO adis16400 debugfs read can use freed device memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: adis16400: fix unprotected debugfs reads\n\nadis16400_serial_number_fops is open coded and never calls\ndebugfs_file_get(), so debugfs_remove_recursive() does not wait for a\nread in progress and unbind frees the iio_dev underneath it.\n\nCommit ae1d37a9bb4b (\"iio: imu: adis16400: use DEFINE_DEBUGFS_ATTRIBUTE\ninstead of DEFINE_SIMPLE_ATTRIBUTE\") converted product_id and\nflash_count to DEFINE_DEBUGFS_ATTRIBUTE, which protects itself, but\nmoved all three files to debugfs_create_file_unsafe().\n\nserial_number prints three registers as \"%.4x-%.4x-%.4x\" and\nDEFINE_DEBUGFS_ATTRIBUTE() formats a single u64, so it cannot be\nconverted without changing what the file returns. adis16475 and\nadis16550 already use debugfs_create_file() for their open coded\nfiles. Use it here too.","summary":"In the Linux IIO driver for the ADIS16400 IMU, the serial_number debugfs file is not protected against unbind, so a read in progress can access memory freed when the device is unbound. The sources do not describe a specific attacker outcome beyond this use-after-free.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adis16400","embedded","iio","linux-kernel","runtime"],"not_affected_if":["no-adis16400-hardware"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing iio: imu: adis16400 debugfs reads (the sources do not list version numbers).","status":"open","published_at":"2026-10-18T16:17:19+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:28+00:00","updated_at":"2026-10-25T05:19:28+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:19:28Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing iio: imu: adis16400 debugfs reads (the sources do not list version numbers).","reach":"local","title":"Linux kernel: IIO adis16400 debugfs read can use freed device memory","impact":"medium","summary":"In the Linux IIO driver for the ADIS16400 IMU, the serial_number debugfs file is not protected against unbind, so a read in progress can access memory freed when the device is unbound. The sources do not describe a specific attacker outcome beyond this use-after-free.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","iio","adis16400","embedded"],"confidence":0.5,"needs_auth":"yes","worst_case":"unknown; use-after-free in kernel memory during device unbind","analyst_note":"Check the NVD entry and the upstream kernel commit for the affected and fixed kernel versions and the CVSS score.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-adis16400-hardware"],"who_is_affected":"Systems running a Linux kernel with the IIO adis16400 IMU driver loaded, where the device can be unbound while debugfs is being read. Systems without this hardware or driver are unlikely to be affected. The sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000607,"input_tokens":3593,"output_tokens":496,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98664':14A,17A '4x':166C,167C,168C 'access':50B 'adis16400':4A,18B,32B,85C,90C,127C 'adis16475':188C 'adis16550':190C 'ae1d37a9bb4b':124C 'alreadi':191C 'attack':65B 'attribut':131C,136C,146C,172C 'beyond':67B 'call':99C 'cannot':179C 'chang':183C 'code':96C,199C 'commit':123C 'convert':137C,181C 'count':142C 'creat':157C,194C 'cve':12A,15A 'debugf':5A,37B,88C,100C,104C,130C,145C,156C,171C,193C 'defin':129C,134C,144C,170C 'describ':62B 'dev':120C 'devic':10A,55B 'driver':29B 'embed':19B 'file':38B,101C,154C,158C,186C,195C,200C 'fix':86C 'flash':141C 'follow':78C 'fop':93C 'format':173C 'free':72B,117C 'freed':9A,52B 'get':102C 'id':139C 'iio':3A,20B,28B,83C,119C,125C 'imu':33B,84C,126C 'instead':132C 'kernel':2A,23B,76C 'linux':1A,22B,27B,75C 'linux-kernel':21B 'memori':11A,51B 'move':151C 'never':98C 'number':36B,92C,161C 'open':95C,198C 'outcom':66B 'print':162C 'product':138C 'progress':48B,114C 'protect':41B,148C 'read':6A,46B,89C,112C 'recurs':106C 'regist':164C 'remov':105C 'resolv':82C 'return':187C 'runtim':24B 'serial':35B,91C,160C 'simpl':135C 'singl':175C 'sourc':59B 'specif':64B 'three':153C,163C 'u64':176C 'unbind':43B,116C 'unbound':57B 'underneath':121C 'unprotect':87C 'unsaf':159C 'use':8A,70B,128C,192C,201C 'use-after-fre':69B 'vulner':79C 'wait':109C 'without':182C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the IIO adis16400 IMU driver loaded, where the device can be unbound while debugfs is being read. Systems without this hardware or driver are unlikely to be affected. The sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98664","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98664","severity":null,"published_at":"2026-10-18T16:17:19+00:00","modified_at":"2026-10-21T13:21:35+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}