{"id":"CVE-2026-98677","kind":"vulnerability","aliases":["CVE-2026-98677"],"related":[],"title":"Linux kernel: IIO ADC driver use-after-free on unbind","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad_sigma_delta: fix use-after-free on unbind\n\nad_sd_buffer_postenable() allocates sigma_delta->samples_buf with\ndevm_krealloc() at runtime, so its devres entry sits after all\nprobe-time entries of the driver. devm resources are released in\nreverse allocation order, which means unbind frees samples_buf before\niio_device_unregister() disables the buffers and detaches the trigger\npollfunc. The data ready IRQ is still enabled at that point, so\nad_sd_trigger_handler() can still run and memcpy() incoming samples\ninto the freed samples_buf.\n\nFix this by preallocating the buffer in\ndevm_ad_sd_setup_buffer_and_trigger(), before the triggered buffer and\nthe IRQ are set up, so it is freed only after iio_device_unregister()\nhas drained the trigger handler via free_irq(). Size it for the worst\ncase of all sequencer slots being active; ad_sd_validate_scan_mask()\nalready caps the number of active channels at num_slots.\n\nThis issue was found by an in-house static analysis tool.","summary":"In the Linux IIO ADC sigma-delta driver, the sample buffer is freed during unbind while the data-ready interrupt can still write into it. An attacker with the ability to trigger that path could corrupt freed kernel memory, but the sources do not describe a reliable exploit.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","iio-adc","linux-kernel","runtime"],"not_affected_if":["driver-not-loaded","no-ad-sigma-delta-hardware"],"how_to_check":"- `uname -r` and check whether the running kernel predates the fix commit for ad_sigma_delta (unknown from sources)\n- `lsmod | grep ad_sigma_delta` to see whether the driver is loaded on the machine\n- Check for an IIO ADC device bound to the ad_sigma_delta driver under `/sys/bus/iio/devices/`","fix":"- Update the Linux kernel to a release that includes the upstream fix (exact version unknown from sources)\n- Until patched, avoid unbinding or removing sigma-delta ADC drivers at runtime (unknown from sources)","status":"open","published_at":"2026-10-18T16:17:21+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:19+00:00","updated_at":"2026-10-25T05:19:19+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:19:19Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix (exact version unknown from sources)\n- Until patched, avoid unbinding or removing sigma-delta ADC drivers at runtime (unknown from sources)","reach":"local","title":"Linux kernel: IIO ADC driver use-after-free on unbind","impact":"medium","summary":"In the Linux IIO ADC sigma-delta driver, the sample buffer is freed during unbind while the data-ready interrupt can still write into it. An attacker with the ability to trigger that path could corrupt freed kernel memory, but the sources do not describe a reliable exploit.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","embedded","iio-adc"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory corruption through freed sample buffer, possible local privilege escalation","analyst_note":"Find the upstream fix commit and affected kernel version range, and confirm whether an unprivileged user can trigger unbind or buffer use.","how_to_check":"- `uname -r` and check whether the running kernel predates the fix commit for ad_sigma_delta (unknown from sources)\n- `lsmod | grep ad_sigma_delta` to see whether the driver is loaded on the machine\n- Check for an IIO ADC device bound to the ad_sigma_delta driver under `/sys/bus/iio/devices/`","needs_analyst":true,"not_affected_if":["no-ad-sigma-delta-hardware","driver-not-loaded"],"who_is_affected":"Only systems running Linux with an IIO sigma-delta ADC driver (ad_sigma_delta based) that has buffered sampling enabled and can be unbound or removed. Systems without that hardware or driver, and those that never unbind these devices, are unlikely to be affected. The sources do not say which specific ADC chips or kernel versions are impacted.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000712,"input_tokens":3613,"output_tokens":702,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98677':14A,17A 'abil':57B 'activ':231C,242C 'ad':88C,98C,163C,187C,232C 'adc':4A,21B,30B,87C 'alloc':102C,132C 'alreadi':237C 'analysi':257C 'attack':54B 'buf':106C,139C,178C 'buffer':37B,100C,146C,184C,190C,196C 'cap':238C 'case':225C 'channel':243C 'corrupt':63B 'could':62B 'cve':12A,15A 'data':45B,153C 'data-readi':44B 'delta':33B,90C,104C 'describ':72B 'detach':148C 'devic':142C,210C 'devm':108C,126C,186C 'devr':114C 'disabl':144C 'drain':213C 'driver':5A,34B,125C 'embed':18B 'enabl':158C 'entri':115C,122C 'exploit':75B 'fix':91C,179C 'follow':81C 'found':250C 'free':9A,95C,137C,218C 'freed':39B,64B,176C,206C 'handler':166C,216C 'hous':255C 'iio':3A,20B,29B,86C,141C,209C 'iio-adc':19B 'in-hous':253C 'incom':172C 'interrupt':47B 'irq':155C,199C,219C 'issu':248C 'kernel':2A,24B,65B,79C 'krealloc':109C 'linux':1A,23B,28B,78C 'linux-kernel':22B 'mask':236C 'mean':135C 'memcpi':171C 'memori':66B 'num':245C 'number':240C 'order':133C 'path':61B 'point':161C 'pollfunc':151C 'posten':101C 'prealloc':182C 'probe':120C 'probe-tim':119C 'readi':46B,154C 'releas':129C 'reliabl':74B 'resolv':85C 'resourc':127C 'revers':131C 'run':169C 'runtim':25B,111C 'sampl':36B,105C,138C,173C,177C 'scan':235C 'sd':99C,164C,188C,233C 'sequenc':228C 'set':201C 'setup':189C 'sigma':32B,89C,103C 'sigma-delta':31B 'sit':116C 'size':220C 'slot':229C,246C 'sourc':69B 'static':256C 'still':49B,157C,168C 'time':121C 'tool':258C 'trigger':59B,150C,165C,192C,195C,215C 'unbind':11A,41B,97C,136C 'unregist':143C,211C 'use':7A,93C 'use-after-fre':6A,92C 'valid':234C 'via':217C 'vulner':82C 'worst':224C 'write':50B","nicknames":[],"mitigations":[],"who_affected":"Only systems running Linux with an IIO sigma-delta ADC driver (ad_sigma_delta based) that has buffered sampling enabled and can be unbound or removed. Systems without that hardware or driver, and those that never unbind these devices, are unlikely to be affected. The sources do not say which specific ADC chips or kernel versions are impacted.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98677","severity":null,"published_at":"2026-10-18T16:17:21+00:00","modified_at":"2026-10-21T13:21:36+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}