CVE-2026-98663: iio: imu: adis16480: fix unprotected debugfs reads
In the Linux kernel, the following vulnerability has been resolved:
iio: imu: adis16480: fix unprotected debugfs reads
The firmwarerevision and firmwaredate file operations are open coded and never call debugfsfileget(), which debugfscreatefileunsafe() requires. debugfsremoverecursive() therefore does not wait for a read in progress, and unbind frees the iiodev underneath it.
Use debugfscreatefile() instead.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Replace the open-coded firmware_revision and firmware_date file operations with debugfs_create_file(); do not call debugfs_file_get() or use debugfs_create_file_unsafe().
Linux kernel iio: imu: adis16480 debugfs debugfs file creation = debugfs_create_file()
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Linux kernel with the ADIS16480 IIO IMU driver are exposed when the driver's firmware_revision or firmware_date debugfs files can be read while the device is being unbound.
What is required to trigger the vulnerability?
A read of the firmware_revision or firmware_date debugfs file must be in progress when the associated device is unbound. The unbind can then free the IIO device before the read completes.
How can this be mitigated if the fix cannot be applied immediately?
Avoid reading the ADIS16480 firmware_revision and firmware_date debugfs files while unbinding the device. Coordinate device removal or driver unbinding so no reads of those files are active.
How can I tell whether my kernel includes the fix?
The fix changes the driver to use debugfs_create_file() rather than debugfs_create_file_unsafe() for these file operations. The provided stable kernel references identify commits carrying the correction.