CVE-2026-98666: iio: gyro: adis16136: fix unprotected debugfs reads
iio: gyro: adis16136: fix unprotected debugfs reads
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Configuration
Replace debugfs_create_file_unsafe() with debugfs_create_file() for the serial_number file operations so debugfs removal waits for reads in progress.
Linux kernel iio gyro adis16136 serial_number debugfs file debugfs file creation API = debugfs_create_file()
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
A read of the ADIS16136 serial_number debugfs file must be in progress while the device is being unbound and its IIO device is freed. The unsafe debugfs file implementation does not make removal wait for the active read.
Who is exposed to this issue?
Systems using the ADIS16136 gyroscope driver are affected when the serial_number debugfs file is accessible and read during device unbind or removal. The provided information does not state whether debugfs is enabled or mounted by default.
What can be done before applying the fix?
Avoid reading the ADIS16136 serial_number debugfs file while the device may be unbound or removed. The resolved implementation replaces the unsafe debugfs file creation with debugfs_create_file(), which provides the required read protection during removal.
How can I determine whether my kernel contains the fix?
Check the ADIS16136 driver's serial_number debugfs file creation. The fix uses debugfs_create_file() rather than debugfs_create_file_unsafe() for this file.