Cloudanix VulnDB

CVE-2026-98672

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux handling of certain sensor chips can make devices crash if the sensor gives a bad reading.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability permits a division by zero during processed channel handling in the stm32-adc driver when an ADC conversion fails or returns a zero value without prior validation.

Why it matters to the business

Embedded or industrial Linux systems using STM32 ADC hardware may suffer unexpected kernel crashes, causing operational downtime and potential loss of sensor-dependent functionality.

How an attack unfolds

An attacker able to influence ADC input conditions, such as by hardware manipulation or sensor fault injection, forces a zero conversion result that the driver processes without checks, triggering the division by zero fault.

How to fix it

Apply the upstream kernel patch adding explicit checks for conversion errors and zero values before any data processing in the stm32-adc driver; rebuild and deploy the updated kernel image.

How to confirm the fix worked

Inspect the stm32-adc source to confirm presence of error and zero-value guards prior to arithmetic operations on conversion results; test with simulated zero conversions.

Typical attack path

  1. Manipulate ADC hardware or inputs to produce a failed or zero conversion
  2. Trigger processed channel data handling in the driver
  3. Execute division operation on the unchecked zero value
  4. Induce kernel fault or panic

How to detect it

Search kernel logs and oops reports for division-by-zero faults occurring during iio or adc processing on stm32 platforms.

  • division by zero
  • stm32-adc
  • iio: adc

What your security team should do

  • Prioritize kernel update on systems exposing the stm32-adc driver
  • Audit device trees and drivers for reliance on this ADC
  • Enable kernel panic logging and monitoring for division-by-zero oops

The record

In the Linux kernel, the following vulnerability has been resolved: iio: adc: stm32-adc: fix possible division by zero in processed channel In case the conversion has failed or returned zero, processing *val can lead to a division by zero. Need to check for errors, or converted value is zero, before processing the data. In case the converted value is zero, e.g. the Vrefint channel, this should be considered as invalid in all cases.

Affected packages

Ecosystem Package Introduced Fixed