CVE-2026-23092: iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source
In the Linux kernel, the following vulnerability has been resolved:
iio: dac: ad3552r-hs: fix out-of-bound write in ad3552rhswritedatasource
When simplewritetobuffer() succeeds, it returns the number of bytes actually copied to the buffer. The code incorrectly uses 'count' as the index for null termination instead of the actual bytes copied. If count exceeds the buffer size, this leads to out-of-bounds write. Add a check for the count and use the return value as the index.
The bug was validated using a demo module that mirrors the original code and was tested under QEMU.
Pattern of the bug: - A fixed 64-byte stack buffer is filled using count. - If count > 64, the code still does buf[count] = '\0', causing an - out-of-bounds write on the stack.
Steps for reproduce: - Opens the device node. - Writes 128 bytes of A to it. - This overflows the 64-byte stack buffer and KASAN reports the OOB.
Found via static analysis. This is similar to the commit da9374819eb3 ("iio: backend: fix out-of-bound write")
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23092?
CVE-2026-23092 is classified as a medium severity vulnerability due to its potential for causing out-of-bounds writes in the Linux kernel.
How do I fix CVE-2026-23092?
To fix CVE-2026-23092, update your Linux kernel to the latest stable version that includes the patched code.
What are the potential impacts of CVE-2026-23092?
The impacts of CVE-2026-23092 include possible denial of service or arbitrary code execution due to out-of-bounds writes.
Which versions of Linux kernel are affected by CVE-2026-23092?
CVE-2026-23092 affects various versions of the Linux kernel where the ad3552r_hs_write_data_source functionality is used.
Is CVE-2026-23092 publicly known?
Yes, CVE-2026-23092 is a publicly known vulnerability documented for awareness and remediation.