CVE-2026-98663: iio: imu: adis16480: fix unprotected debugfs reads
iio: imu: adis16480: fix unprotected debugfs reads
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Configuration
Use debugfs_create_file() instead of debugfs_create_file_unsafe() for the firmware_revision and firmware_date file operations.
iio: imu: adis16480 debugfs file creation API = debugfs_create_file()
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Linux kernel with the ADIS16480 IIO IMU driver are exposed when the driver's firmware_revision or firmware_date debugfs files can be read while the device is being unbound.
What is required to trigger the vulnerability?
A read of the firmware_revision or firmware_date debugfs file must be in progress when the associated device is unbound. The unbind can then free the IIO device before the read completes.
How can this be mitigated if the fix cannot be applied immediately?
Avoid reading the ADIS16480 firmware_revision and firmware_date debugfs files while unbinding the device. Coordinate device removal or driver unbinding so no reads of those files are active.
How can I tell whether my kernel includes the fix?
The fix changes the driver to use debugfs_create_file() rather than debugfs_create_file_unsafe() for these file operations. The provided stable kernel references identify commits carrying the correction.