CVE-2026-64501: iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: adsigmadelta: fix CS held asserted and state leaks
In adsigmadeltasingleconversion(), setmode(ADSDMODEIDLE) and disableone() were called from the out: block while keepcsasserted was still true. This caused any SPI transfer issued by those callbacks to carry cschange=1, leaving CS permanently asserted after the conversion. Fix by moving both calls into the outunlock: block, after keepcsasserted is cleared, matching the pattern already used in adsdcalibrate().
In the error path of adsdbufferpostenable(), if an operation fails after setmode(ADSDMODECONTINUOUS) has already succeeded (e.g. spioffloadtriggerenable()), the device is left in continuous conversion mode with CS physically asserted. Additionally, buslocked remaining true after spibusunlock() causes subsequent SPI operations to call spisynclocked() without the bus lock actually held, allowing concurrent SPI access.
Fix the error path by clearing keepcsasserted first, then calling setmode(ADSDMODEIDLE) to revert the device mode and deassert CS, then clearing buslocked before releasing the bus.
For devices that implement neither setmode nor disableone (such as MAX11205, which has no physical CS pin), no SPI transfer is issued during cleanup and the cschange flag has no effect on any physical line.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the error path by clearing keep_cs_asserted first, then calling the SPI operation(s)/cleanup in the error path (instead of leaving keep_cs_asserted asserted).
ad_sd_buffer_postenable() keep_cs_asserted = cleared first - Configuration
Fix the control-flow bug by moving both calls into the out_unlock: block, after the point indicated in the text, so that CS deassert/state cleanup happens correctly on unlock.
ad_sd_buffer_postenable() call ordering (out_unlock/out block) = move both calls into out_unlock block - Configuration
In ad_sigma_delta_single_conversion(), call set_mode(AD_SD_MODE_IDLE) to revert the device mode and deassert CS after the conversion so the device is not left in continuous mode.
ad_sigma_delta_single_conversion() set_mode(AD_SD_MODE_IDLE) = AD_SD_MODE_IDLE - Configuration
Prevent CS permanently asserted and concurrent SPI access by clearing bus_locked before releasing the bus, ensuring disable_one()/cs_change cleanup occurs with keep_cs_asserted cleared so the cs_change flag affects physical CS as intended.
Linux kernel (ad_sigma_delta / SPI locking behavior) bus lock and cs_change effect = clear bus_locked before releasing the bus; rely on cs_change only when CS is managed
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64501?
The severity of CVE-2026-64501 is rated as high with a CVSS score of 7.1.
What are the risks associated with CVE-2026-64501?
The risks associated with CVE-2026-64501 include potential information leakage and denial of service due to incorrect handling of the state during single conversion processes.
How do I fix CVE-2026-64501?
To fix CVE-2026-64501, upgrade to the latest version of the Linux kernel that includes the patch addressing this vulnerability.
What systems are affected by CVE-2026-64501?
CVE-2026-64501 affects systems running the vulnerable versions of the Linux kernel with the iio: adc: ad_sigma_delta driver.
When was CVE-2026-64501 published?
CVE-2026-64501 was published on July 25, 2026.