CVE-2026-98671

What it actually does

On failure of devm_thermal_of_zone_register in the sun4i-gpadc-iio probe path, the driver returns without unregistering the IIO map array or disabling runtime PM, leaving resources registered and power management in an inconsistent state.

Why it matters to the business

Embedded Linux systems using the affected ADC driver may experience resource leaks or instability during device initialization failures, increasing maintenance overhead on devices with thermal or sensor hardware.

How an attack unfolds

An attacker or faulty hardware triggers a thermal zone registration failure during driver probe; the missing error-path cleanup leaves dangling mappings that can later be abused for local denial of service or state confusion.

How to fix it

Apply the upstream fix that adds the jump to err_map on thermal registration failure; update to a Linux kernel containing this commit or later.

How to confirm the fix worked

Inspect the probe function in sun4i-gpadc-iio.c for the err_map jump label after the thermal registration call; confirm dmesg shows proper unregistration on simulated failure paths.

Typical attack path

1. Load or trigger probe of sun4i-gpadc-iio driver
2. Cause devm_thermal_of_zone_register to fail
3. Driver returns without executing cleanup for IIO maps or runtime PM
4. Subsequent operations encounter leaked resources or inconsistent PM state

How to detect it

Review kernel logs and driver probe traces for sun4i-gpadc-iio entries that report thermal registration failure without subsequent unmap or PM disable messages; examine device initialization sequences around IIO and thermal subsystems.

What your security team should do

• Prioritize kernel updates on systems exposing the sun4i-gpadc-iio driver
• Monitor kernel logs for repeated probe failures involving thermal zone registration
• Test driver behavior under error injection on representative hardware