Live › vulnerability › CVE-2026-98677
Go to dashboardIn the Linux IIO ADC sigma-delta driver, the sample buffer is freed during unbind while the data-ready interrupt can still write into it. An attacker with the ability to trigger that path could corrupt freed kernel memory, but the sources do not describe a reliable exploit.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems running Linux with an IIO sigma-delta ADC driver (ad_sigma_delta based) that has buffered sampling enabled and can be unbound or removed. Systems without that hardware or driver, and those that never unbind these devices, are unlikely to be affected. The sources do not say which specific ADC chips or kernel versions are impacted.
No product ranges from the sources yet.
uname -r and check whether the running kernel predates the fix commit for ad_sigma_delta (unknown from sources)lsmod | grep ad_sigma_delta to see whether the driver is loaded on the machine/sys/bus/iio/devices/Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: ad_sigma_delta: fix use-after-free on unbind
ad_sd_buffer_postenable() allocates sigma_delta->samples_buf with devm_krealloc() at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources are released in reverse allocation order, which means unbind frees samples_buf before iio_device_unregister() disables the buffers and detaches the trigger pollfunc. The data ready IRQ is still enabled at that point, so ad_sd_trigger_handler() can still run and memcpy() incoming samples into the freed samples_buf.
Fix this by preallocating the buffer in devm_ad_sd_setup_buffer_and_trigger(), before the triggered buffer and the IRQ are set up, so it is freed only after iio_device_unregister() has drained the trigger handler via free_irq(). Size it for the worst case of all sequencer slots being active; ad_sd_validate_scan_mask() already caps the number of active channels at num_slots.
This issue was found by an in-house static analysis tool.
This page as .md · .json · in your agent: get_signal("CVE-2026-98677")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.