---
id: "CVE-2026-98677"
kind: "vulnerability"
aliases: ["CVE-2026-98677"]
title: "Linux kernel: IIO ADC driver use-after-free on unbind"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["embedded", "iio-adc", "linux-kernel", "runtime"]
not_affected_if: ["driver-not-loaded", "no-ad-sigma-delta-hardware"]
published_at: "2026-10-18T16:17:21+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:19:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98677", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: IIO ADC driver use-after-free on unbind

In the Linux IIO ADC sigma-delta driver, the sample buffer is freed during unbind while the data-ready interrupt can still write into it. An attacker with the ability to trigger that path could corrupt freed kernel memory, but the sources do not describe a reliable exploit.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and check whether the running kernel predates the fix commit for ad_sigma_delta (unknown from sources)
- `lsmod | grep ad_sigma_delta` to see whether the driver is loaded on the machine
- Check for an IIO ADC device bound to the ad_sigma_delta driver under `/sys/bus/iio/devices/`

## Fix

- Update the Linux kernel to a release that includes the upstream fix (exact version unknown from sources)
- Until patched, avoid unbinding or removing sigma-delta ADC drivers at runtime (unknown from sources)

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98677

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: ad_sigma_delta: fix use-after-free on unbind

ad_sd_buffer_postenable() allocates sigma_delta->samples_buf with
devm_krealloc() at runtime, so its devres entry sits after all
probe-time entries of the driver. devm resources are released in
reverse allocation order, which means unbind frees samples_buf before
iio_device_unregister() disables the buffers and detaches the trigger
pollfunc. The data ready IRQ is still enabled at that point, so
ad_sd_trigger_handler() can still run and memcpy() incoming samples
into the freed samples_buf.

Fix this by preallocating the buffer in
devm_ad_sd_setup_buffer_and_trigger(), before the triggered buffer and
the IRQ are set up, so it is freed only after iio_device_unregister()
has drained the trigger handler via free_irq(). Size it for the worst
case of all sequencer slots being active; ad_sd_validate_scan_mask()
already caps the number of active channels at num_slots.

This issue was found by an in-house static analysis tool.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_