CVE-2026-98666: iio: gyro: adis16136: fix unprotected debugfs reads
In the Linux kernel, the following vulnerability has been resolved:
iio: gyro: adis16136: fix unprotected debugfs reads
The serialnumber file operations are open coded and never call debugfsfileget(), which debugfscreatefileunsafe() requires. debugfsremoverecursive() therefore does not wait for a read in progress, and unbind frees the iiodev underneath it.
Use debugfscreatefile() instead.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Replace the open-coded serial_number debugfs file operations with debugfs_create_file() so that debugfs_file_get() is called and debugfs_remove_recursive() waits for reads to finish before unbind frees the iio_dev.
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
A read of the ADIS16136 serial_number debugfs file must be in progress while the device is being unbound and its IIO device is freed. The unsafe debugfs file implementation does not make removal wait for the active read.
Who is exposed to this issue?
Systems using the ADIS16136 gyroscope driver are affected when the serial_number debugfs file is accessible and read during device unbind or removal. The provided information does not state whether debugfs is enabled or mounted by default.
What can be done before applying the fix?
Avoid reading the ADIS16136 serial_number debugfs file while the device may be unbound or removed. The resolved implementation replaces the unsafe debugfs file creation with debugfs_create_file(), which provides the required read protection during removal.
How can I determine whether my kernel contains the fix?
Check the ADIS16136 driver's serial_number debugfs file creation. The fix uses debugfs_create_file() rather than debugfs_create_file_unsafe() for this file.