CVE-2026-98677: iio: adc: ad_sigma_delta: fix use-after-free on unbind
iio: adc: adsigmadelta: fix use-after-free on unbind
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In devm_ad_sigma_delta_setup_buffer_and_trigger(), preallocate sigma_delta->samples_buf before setting up the triggered buffer and IRQ, sizing it for the worst case of all sequencer slots being active, so it is freed only after iio_device_unregister() has drained the trigger handler via free_irq().
Event History
Frequently Asked Questions
When can the use-after-free occur?
It can occur during device unbind, after the sample buffer has been freed but before IIO device unregistration has disabled buffers, detached the trigger poll function, and drained the data-ready IRQ handler.
What runtime condition is needed to trigger the freed-memory access?
A data-ready IRQ must run in the unbind window. The trigger handler can then copy incoming samples into the already-freed samples buffer.
Which component behavior causes the unsafe teardown order?
The sample buffer was allocated with devm_krealloc() at runtime, placing its devres entry after probe-time resources. Because devm releases resources in reverse allocation order, that buffer was released before the IRQ was freed.
What does the fix change?
The fix preallocates the sample buffer during buffer-and-trigger setup, before the triggered buffer and IRQ are established. This makes the buffer persist until after iio_device_unregister() drains the trigger handler through free_irq().