UBUNTU-CVE-2026-98677: Use After Free
In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix use-after-free on unbind adsdbufferpostenable() allocates sigmadelta->samplesbuf with devmkrealloc() at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources are released in reverse allocation order, which means unbind frees samplesbuf before iiodeviceunregister() disables the buffers and detaches the trigger pollfunc. The data ready IRQ is still enabled at that point, so adsdtriggerhandler() can still run and memcpy() incoming samples into the freed samplesbuf. Fix this by preallocating the buffer in devmadsdsetupbufferandtrigger(), before the triggered buffer and the IRQ are set up, so it is freed only after iiodeviceunregister() has drained the trigger handler via freeirq(). Size it for the worst case of all sequencer slots being active; adsdvalidatescanmask() already caps the number of active channels at numslots. This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Preallocate sigma_delta->samples_buf in devm_ad_sd_setup_buffer_and_trigger() before the triggered buffer and IRQ are set up, using a size for the worst case of all sequencer slots being active; ad_sd_validate_scan_mask() caps active channels at num_slots.
Linux kernel iio: adc: ad_sigma_delta sigma_delta->samples_buf allocation = Preallocate before setting up the triggered buffer and IRQ, sized for all sequencer slots to be active