CVE-2026-53386

What it actually does

This is an out-of-bounds array access in the Linux kernel Industrial I/O ADS1298 ADC driver. The driver uses a value derived from the ADS1298 channel PGA bit field as an index into the ads1298_pga_settings array, which has 7 valid elements, while the mask can produce values 0 through 7. If the reserved value 7 is processed, the kernel can read outside the intended array bounds. Because this occurs in kernel space, the practical impact can include kernel memory disclosure, memory corruption side effects, system crash, or potentially local privilege escalation depending on compiler layout, kernel hardening, and reachable driver paths.

Why it matters to the business

Affected Linux systems that include and use the TI ADS1298 ADC driver could be destabilized or compromised by a local attacker with the ability to interact with the device or its IIO interfaces. The most likely operational consequence is a system crash or device malfunction, but the CVSS rating reflects the possibility of high-impact confidentiality, integrity, and availability compromise. Risk is concentrated in embedded, industrial, medical, monitoring, or data-acquisition systems using ADS1298-compatible hardware. EPSS is currently very low, the issue is not in CISA KEV, and no public exploit maturity is reported, so broad internet-scale exploitation is unlikely; however, systems with local multi-user access or exposed device-management paths should prioritize remediation.

How an attack unfolds

An attacker first obtains local access to a Linux system where the ADS1298 Industrial I/O ADC driver is present and the relevant hardware or device node is reachable. They then identify the IIO device interfaces or another path that causes the driver to parse ADS1298 channel PGA settings. By causing the PGA field to contain the reserved binary value 111, the driver calculates an index value of 7. Vulnerable kernels use that value directly to access ads1298_pga_settings, whose valid indices are only 0 through 6. The resulting out-of-bounds kernel access may trigger a kernel oops, expose adjacent kernel memory through driver behavior, or create conditions that can be shaped into local privilege escalation on susceptible builds. The exploitability depends heavily on hardware availability, permissions on IIO device interfaces, kernel configuration, memory layout, and hardening such as KASAN, slab hardening, SMEP/SMAP, and lockdown mode.

How to fix it

Update to a Linux kernel or vendor kernel package that includes the ADS1298 driver fix adding a bounds check for the PGA settings index and returning -EINVAL when the value is out of range. No exact fixed package versions were provided, so use distribution and device-vendor advisories to identify the first patched kernel for the affected product line. Where immediate patching is not possible, reduce exposure by disabling or blacklisting the ti-ads1298 driver if ADS1298 hardware is not required, restricting local access to Industrial I/O device nodes under /sys/bus/iio and /dev, limiting shell access on embedded systems, and applying kernel hardening controls such as lockdown mode, module loading restrictions, and least-privilege device permissions. For custom kernels, backport the upstream change that validates the ads1298_pga_settings index before array access.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel or vendor kernel package contains the bounds check in the TI ADS1298 ADC driver. On source-based or custom builds, inspect drivers/iio/adc/ti-ads1298.c and confirm the PGA index is checked against the size of ads1298_pga_settings and returns -EINVAL for out-of-range values. On packaged systems, confirm the installed kernel version matches the vendor advisory for this issue and reboot into the patched kernel. Validate exposure by checking whether the ADS1298 driver is built, loaded, or available as a module, for example through kernel configuration, lsmod, modinfo, /sys/module, and dmesg. If the driver is not present and cannot be loaded, the system is not exposed through this driver. If the driver is present but unused, validate that it is blacklisted or otherwise unavailable to untrusted local users.

Typical attack path

1. Gain local access to a Linux system running a vulnerable kernel with the TI ADS1298 ADC driver available.
2. Confirm that ADS1298-compatible hardware or a reachable IIO device interface is present.
3. Interact with device configuration paths that cause the driver to read or process channel PGA settings.
4. Set or induce the reserved PGA value 7, represented as binary 111, for a channel.
5. Trigger the vulnerable driver code path so the reserved value is used as an index into ads1298_pga_settings.
6. Leverage the resulting out-of-bounds kernel access to crash the system, disclose kernel memory, or attempt local privilege escalation depending on platform conditions.

How to detect it

There are no known public exploit indicators or KEV-listed exploitation for this issue. Detection should focus on signs of local abuse and kernel fault artifacts on systems where the ti-ads1298 driver is present. Review kernel logs, persistent journald records, dmesg captures, crash dumps, pstore/ramoops data, and monitoring alerts for kernel oops, panic, KASAN, UBSAN, or general protection fault messages referencing ti-ads1298, ads1298, ads1298_pga_settings, or Industrial I/O ADC paths. Correlate such events with local login records, sudo usage, service account activity, container/device passthrough events, and modifications or writes to IIO sysfs attributes under /sys/bus/iio/devices/. On embedded systems, also review field-service access, remote management sessions, and application logs for unexpected ADC reconfiguration shortly before a crash. Absence of these artifacts does not prove non-exploitation, because successful memory corruption may leave limited evidence.

• ti-ads1298
• ads1298
• ads1298_pga_settings
• drivers/iio/adc/ti-ads1298.c
• /sys/bus/iio/devices/iio:device
• /sys/module/ti_ads1298
• KASAN: global-out-of-bounds
• KASAN: slab-out-of-bounds
• UBSAN: array-index-out-of-bounds
• kernel BUG at drivers/iio/adc/ti-ads1298.c
• Oops:
• Unable to handle kernel paging request
• general protection fault
• industrialio
• iio:device

What your security team should do

• Inventory Linux systems, embedded appliances, and data-acquisition platforms for use of ADS1298-compatible ADC hardware or the ti-ads1298 kernel driver.
• Prioritize patching systems where local users, containers with device access, field-service accounts, or remote-management functions can reach IIO device interfaces.
• Upgrade to vendor kernels that include the ADS1298 bounds-check fix; for custom kernels, backport and rebuild the fixed driver.
• If ADS1298 hardware is not required, disable or blacklist the ti-ads1298 module and remove unnecessary device access from untrusted workloads.
• Restrict permissions on IIO sysfs and device nodes so only trusted services can interact with ADC configuration interfaces.
• Monitor kernel logs for crashes, KASAN reports, or oops traces involving ti-ads1298, ads1298, or Industrial I/O device handling.
• Treat unexpected kernel crashes on systems using ADS1298 hardware as potentially security-relevant until logs and device access history are reviewed.