CVE-2026-98666

What it actually does

The vulnerability allows a use-after-free condition because the serial_number debugfs file operations are open-coded without calling debugfs_file_get(), so debugfs_remove_recursive does not wait for in-progress reads and unbind frees the iio_dev underneath an active access.

Why it matters to the business

Systems using the ADIS16136 gyroscope sensor may experience kernel crashes or instability that interrupt operations and, if successfully exploited, could allow local attackers to execute arbitrary code with kernel privileges.

How an attack unfolds

An attacker with local access locates the unprotected serial_number debugfs entry, starts a read operation, and concurrently triggers device unbind or removal, causing the underlying iio_dev structure to be freed while still in use.

How to fix it

Update the Linux kernel to a version that replaces debugfs_create_file_unsafe with debugfs_create_file for the serial_number operations in the adis16136 driver.

How to confirm the fix worked

Inspect the adis16136 driver source to confirm debugfs_create_file is used for serial_number, then verify that debugfs_remove_recursive waits for in-flight reads before freeing structures.

Typical attack path

1. Obtain local access to a Linux system exposing the adis16136 debugfs interface
2. Identify the serial_number debugfs file for the device
3. Begin a read on the serial_number entry
4. Trigger device unbind or removal via sysfs or module unload
5. Leverage the resulting use-after-free for kernel code execution or denial of service

How to detect it

Review kernel logs and crash dumps for use-after-free patterns involving iio or debugfs structures during device unbind events.

What your security team should do

• Apply the kernel fix as soon as a patched version is available
• Restrict unprivileged local access on systems exposing this debugfs interface
• Monitor kernel logs for oops or warnings involving iio_dev or debugfs during device removal