CVE-2026-98678: iio: adc: ad4030: fix invalid oversampling_ratio validation
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: ad4030: fix invalid oversamplingratio validation
In ad4030setavgframelen(), the logarithm is calculated before input validation. Passing zero or negative values leads to an undefined result from ilog2().
Validate that the input is strictly positive prior to computing its logarithm.
Affected Software
Event History
Frequently Asked Questions
What input is required to trigger the issue?
The AD4030 driver's oversampling_ratio input must be set to zero or a negative value. The affected function calculates ilog2() before validating that this value is strictly positive.
What is the immediate mitigation if the kernel update cannot be applied?
Ensure oversampling_ratio is configured only with strictly positive values. Do not pass zero or negative values to the AD4030 driver's averaging-frame-length configuration.
How can I determine whether my kernel includes the fix?
Check whether the kernel source or applied stable patches includes the change that validates oversampling_ratio as strictly positive before calling ilog2() in ad4030_set_avg_frame_len(). The provided stable references identify commits containing the fix.