CVE-2026-98664: iio: imu: adis16400: fix unprotected debugfs reads
In the Linux kernel, the following vulnerability has been resolved:
iio: imu: adis16400: fix unprotected debugfs reads
adis16400serialnumberfops is open coded and never calls debugfsfileget(), so debugfsremoverecursive() does not wait for a read in progress and unbind frees the iiodev underneath it.
Commit ae1d37a9bb4b ("iio: imu: adis16400: use DEFINEDEBUGFSATTRIBUTE instead of DEFINESIMPLEATTRIBUTE") converted productid and flashcount to DEFINEDEBUGFSATTRIBUTE, which protects itself, but moved all three files to debugfscreatefileunsafe().
serialnumber prints three registers as "%.4x-%.4x-%.4x" and DEFINEDEBUGFSATTRIBUTE() formats a single u64, so it cannot be converted without changing what the file returns. adis16475 and adis16550 already use debugfscreatefile() for their open coded files. Use it here too.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch ae1d37a9bb4b