Live › vulnerability › CVE-2026-98666
Go to dashboardThe adis16136 IIO gyroscope driver exposes a serial_number debugfs file whose read handlers skip the debugfs protection call, so a read in progress is not waited for when the driver unbinds. A read racing with unbind can then touch memory already freed, which can crash the kernel or lead to further memory corruption.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems that load the adis16136 gyroscope driver (CONFIG_ADIS16136 or the module) and have debugfs mounted are plausibly exposed; the driver is for a specific Analog Devices sensor, so most servers and general desktops can skip it. The sources do not say which kernel versions are affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
iio: gyro: adis16136: fix unprotected debugfs reads
The serial_number file operations are open coded and never call debugfs_file_get(), which debugfs_create_file_unsafe() requires. debugfs_remove_recursive() therefore does not wait for a read in progress, and unbind frees the iio_dev underneath it.
Use debugfs_create_file() instead.
This page as .md · .json · in your agent: get_signal("CVE-2026-98666")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.