CVE-2026-98663

What it actually does

Race condition in ADIS16480 IMU debugfs handlers allows debugfs_remove_recursive to proceed without waiting for in-flight reads, freeing iio_dev while a read is active and causing use-after-free.

Why it matters to the business

Kernel instability or crashes can occur during driver unload on systems using the affected IMU, increasing downtime risk for industrial or embedded deployments that rely on this sensor.

How an attack unfolds

An attacker with local access triggers repeated reads on the unprotected firmware_revision or firmware_date debugfs files while concurrently unbinding the driver module, racing the free of the backing iio_dev structure.

How to fix it

Apply the upstream fix that replaces debugfs_create_file_unsafe with debugfs_create_file for the two file operations; rebuild and deploy the updated kernel module.

How to confirm the fix worked

Inspect the adis16480 driver source for use of debugfs_create_file on firmware_revision and firmware_date, and confirm absence of debugfs_create_file_unsafe calls for those handlers.

Typical attack path

1. Locate the ADIS16480 debugfs entries under /sys/kernel/debug/iio/
2. Open and hold reads on firmware_revision or firmware_date files
3. Trigger driver unbind via sysfs or module removal in a separate thread
4. Continue read operations to access freed memory

How to detect it

Review kernel logs for oops, KASAN reports, or warnings referencing adis16480 and debugfs_file_get; correlate with module unload events in dmesg or audit logs.

What your security team should do

• Patch affected kernels with the debugfs protection fix as soon as vendor packages are available
• Limit local unprivileged access on systems exposing the IMU debugfs interface
• Monitor kernel oops and use-after-free reports involving iio_dev or adis16480