---
id: "CVE-2026-98678"
kind: "vulnerability"
aliases: ["CVE-2026-98678"]
title: "Linux kernel: AD4030 ADC driver mishandles zero oversampling ratio input"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ad4030", "iio", "infrastructure", "linux-kernel"]
not_affected_if: []
published_at: "2026-10-18T16:17:21+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:19:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98678", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: AD4030 ADC driver mishandles zero oversampling ratio input

In the Linux kernel's IIO ADC driver for the AD4030, the oversampling ratio setter computes a logarithm before validating its input, so zero or negative values produce an undefined result from ilog2(). The sources describe a fix that validates the input is strictly positive before the logarithm is computed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98678

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: ad4030: fix invalid oversampling_ratio validation

In ad4030_set_avg_frame_len(), the logarithm is calculated before input
validation. Passing zero or negative values leads to an undefined result
from ilog2().

Validate that the input is strictly positive prior to computing its
logarithm.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_