CVE-2026-98677 iio: adc: ad_sigma_delta: fix use-after-free on unbind
MediumCVSS 5.7
EPSS 0.21%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: ad_sigma_delta: fix use-after-free on unbind
ad_sd_buffer_postenable() allocates sigma_delta->samples_buf with
devm_krealloc() at runtime, so its devres entry sits after all
probe-time entries of the driver. devm resources are released in
reverse allocation order, which means unbind frees samples_buf before
iio_device_unregister() disables the buffers and detaches the trigger
pollfunc. The data ready IRQ is still enabled at that point, so
ad_sd_trigger_handler() can still run and memcpy() incoming samples
into the freed samples_buf.
Fix this by preallocating the buffer in
devm_ad_sd_setup_buffer_and_trigger(), before the triggered buffer and
the IRQ are set up, so it is freed only after iio_device_unregister()
has drained the trigger handler via free_irq(). Size it for the worst
case of all sequencer slots being active; ad_sd_validate_scan_mask()
already caps the number of active channels at num_slots.
This issue was found by an in-house static analysis tool.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux kernel | >= 8bea9af887de4c99a95f93f2ce400ef63e8b4e9b, < b2a991d33f1e2207052fe745d1fe459db8b365e2 | b2a991d33f1e2207052fe745d1fe459db8b365e2 |
| Linux kernel | >= 8bea9af887de4c99a95f93f2ce400ef63e8b4e9b, < 975b09bc680acc60903777b766cdb53b0bf9c9f6 | 975b09bc680acc60903777b766cdb53b0bf9c9f6 |
| Linux kernel | >= 8bea9af887de4c99a95f93f2ce400ef63e8b4e9b, < 84500ae0d976995a6870cb1dca2d124b6b2d6e5a | 84500ae0d976995a6870cb1dca2d124b6b2d6e5a |
| Linux kernel | >= 8bea9af887de4c99a95f93f2ce400ef63e8b4e9b, < f20b94a7dc1ff9ade191ce839c984210fdbdc653 | f20b94a7dc1ff9ade191ce839c984210fdbdc653 |
| Linux kernel | >= 8bea9af887de4c99a95f93f2ce400ef63e8b4e9b, < 5663c72bf400231e90777982216797191887a6b9 | 5663c72bf400231e90777982216797191887a6b9 |
| Linux kernel | >= 8bea9af887de4c99a95f93f2ce400ef63e8b4e9b, < 9ee8306121495d2a25aa5d1bfd519f2748786b83 | 9ee8306121495d2a25aa5d1bfd519f2748786b83 |
| Linux kernel | = 5.19 | No fix listed |
| Linux kernel | < 6.1.191 | 6.1.191 |
| Linux kernel | < 6.6.160 | 6.6.160 |
| Linux kernel | < 6.12.113 | 6.12.113 |
| Linux kernel | < 6.18.56 | 6.18.56 |
| Linux kernel | < 7.2.10 | 7.2.10 |
| Linux kernel | < 7.3 | 7.3 |
| debian/linux(Debian:12) | All versions | No fix listed |
| debian/linux(Debian:12) | = 6.1.106-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.106-2 | No fix listed |
| debian/linux(Debian:12) | = 6.1.106-3 | No fix listed |
| debian/linux(Debian:12) | = 6.1.112-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.115-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.119-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.123-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.124-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.128-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.129-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.133-1 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | = 6.1.135-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.137-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.139-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.140-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.147-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.148-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.153-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.158-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.159-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.162-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.164-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.170-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.170-2 | No fix listed |
| debian/linux(Debian:12) | = 6.1.170-3 | No fix listed |
| debian/linux(Debian:12) | = 6.1.172-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.174-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.176-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.177-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.180-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.187-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.190-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.27-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.37-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-2 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-2~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-3 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-4 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-4~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.52-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.55-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.55-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.64-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.66-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.67-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.69-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.69-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.76-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.76-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.82-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.85-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.90-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.90-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.94-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.94-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.98-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.99-1 | No fix listed |
| debian/linux(Debian:12) | = 6.10-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.10.1-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.10.11-1 | No fix listed |
| debian/linux(Debian:12) | = 6.10.11-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.10.12-1 | No fix listed |
| debian/linux(Debian:12) | = 6.10.3-1 | No fix listed |
| debian/linux(Debian:12) | = 6.10.4-1 | No fix listed |
| debian/linux(Debian:12) | = 6.10.6-1 | No fix listed |
| debian/linux(Debian:12) | = 6.10.6-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.10.7-1 | No fix listed |
| debian/linux(Debian:12) | = 6.10.9-1 | No fix listed |
| debian/linux(Debian:12) | = 6.11-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.11.10-1 | No fix listed |
| debian/linux(Debian:12) | = 6.11.10-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.11.2-1 | No fix listed |
| debian/linux(Debian:12) | = 6.11.4-1 | No fix listed |
| debian/linux(Debian:12) | = 6.11.5-1 | No fix listed |
| debian/linux(Debian:12) | = 6.11.5-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.11.6-1 | No fix listed |
| debian/linux(Debian:12) | = 6.11.7-1 | No fix listed |
| debian/linux(Debian:12) | = 6.11.9-1 | No fix listed |
| debian/linux(Debian:12) | = 6.11~rc4-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.11~rc5-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.10-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.100-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.101-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.105-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.107-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.11-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.11-1+alpha | No fix listed |
| debian/linux(Debian:12) | = 6.12.11-1+alpha.1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.111-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.113-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.12-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.12-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.13-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.15-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.16-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.17-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.19-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.20-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.21-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.22-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.22-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.25-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.27-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.27-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.29-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.3-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.30-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.30-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.31-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.32-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.32-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.33-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.33-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.35-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.35-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.37-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.38-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.38-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.41-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.43-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.43-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.48-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.5-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.57-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.57-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.6-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.63-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.63-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.69-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.69-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.73-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.73-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.74-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.74-2 | No fix listed |
| debian/linux(Debian:12) | = 6.12.74-2~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.8-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.85-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.85-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.86-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.86-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.88-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.88-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.9-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.9-1+alpha | No fix listed |
| debian/linux(Debian:12) | = 6.12.9-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.90-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.90-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.90-2 | No fix listed |
| debian/linux(Debian:12) | = 6.12.90-2~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.94-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.94-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.95-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.95-1~bpo12+1 | No fix listed |
| debian/linux(Debian:12) | = 6.12.96-1 | No fix listed |
| debian/linux(Debian:12) | = 6.12~rc6-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.13.10-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.13.11-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.13.2-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.13.3-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.13.4-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.13.5-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.13.6-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.13.7-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.13.8-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.13.9-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.13~rc6-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.13~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.14.3-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.14.5-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.14.6-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.15-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.15.1-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.15.2-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.15.3-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.15.4-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.15.5-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.15.6-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.15~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.16-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.16.1-1~exp1 | No fix listed |
| debian/linux(Debian:12) | = 6.16.10-1 | No fix listed |
| debian/linux(Debian:12) | = 6.16.11-1 | No fix listed |
| debian/linux(Debian:12) | = 6.16.12-1 | No fix listed |
| debian/linux(Debian:12) | = 6.16.12-1~bpo13+1 | No fix listed |
| debian/linux(Debian:12) | = 6.16.12-2 | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory
- Red Hat CVE page vendor-advisory
- Red Hat Bugzilla 2555147 issue-tracking
- www.cve.org
- nvd.nist.gov
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- USN-9040-1: Linux kernel (Low Latency NVIDIA) vulnerabilities vendor-advisory
- USN-9039-1: Linux kernel (Azure CVM) vulnerabilities vendor-advisory
- Debian Security Tracker CVE-2026-98677 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-9066-1: Linux kernel (HWE) vulnerabilities vendor-advisory
- USN-9018-2: Linux kernel (HWE) vulnerabilities vendor-advisory
- USN-9091-1: Linux kernel (NVIDIA Tegra) vulnerabilities vendor-advisory