CVE-2026-93051

What it actually does

Manual per-RDAC sysfs creation in ad_dpot_probe combined with optional command group leaves partial state that remove must exactly mirror, enabling use-after-free when device attributes outlive freed driver data.

Why it matters to the business

Local attackers with ability to load or remove the ad525x_dpot driver can crash the kernel or potentially execute code, risking denial of service on affected Linux systems and complicating driver maintenance.

How an attack unfolds

An attacker loads the vulnerable I2C or SPI ad525x_dpot driver, triggers probe to create manual sysfs files, then forces an error path or module removal so that the remove callback references already-freed structures via dangling sysfs attributes.

How to fix it

Update to a Linux kernel containing the fix that moves attributes into dev_groups with is_visible callbacks for both I2C and SPI drivers; rebuild and reboot with the corrected kernel.

How to confirm the fix worked

Confirm the driver source uses dev_groups plus is_visible instead of manual sysfs creation in probe, then load the module on test hardware and verify sysfs files appear only after successful probe and are removed before driver data is freed.

Typical attack path

1. Load ad525x_dpot I2C or SPI module on a system with supported digital potentiometer hardware
2. Trigger probe that manually registers per-RDAC sysfs files and optional command group
3. Induce probe failure or module unload before full cleanup
4. Access or trigger removal of dangling sysfs entries to cause use-after-free

How to detect it

Search kernel logs for ad525x_dpot probe/remove mismatches, oops or slab-use-after-free reports referencing sysfs or ad_dpot, and any unusual module load/unload sequences involving the driver.

What your security team should do

• Prioritize kernel update on any system exposing the ad525x_dpot driver
• Audit custom kernels or out-of-tree versions of the driver for the same manual sysfs pattern
• Monitor for local privilege-escalation attempts targeting digital potentiometer drivers