Cloudanix VulnDB

CVE-2026-98677

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A memory-handling error in the Linux kernel for certain sensor chips can cause crashes or corruption when the hardware is disconnected.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in ad_sigma_delta driver: devm_krealloc-allocated samples_buf is released before iio_device_unregister disables the trigger and IRQ, allowing ad_sd_trigger_handler to memcpy into the freed buffer on data-ready interrupt.

Why it matters to the business

Kernel memory corruption or crashes on systems using supported sigma-delta ADCs when the driver is unbound or the device removed; low immediate risk given narrow hardware scope and absence from known exploits.

How an attack unfolds

An attacker with local access unloads the module or triggers device removal while the buffer and IRQ are active; the still-enabled data-ready interrupt then causes the handler to write into already-freed memory.

How to fix it

Apply the upstream fix that moves buffer allocation into devm_ad_sd_setup_buffer_and_trigger before IRQ setup; rebuild and deploy the patched kernel on affected systems.

How to confirm the fix worked

Confirm the preallocation change exists in ad_sd_buffer_postenable and that samples_buf lifetime now ends after free_irq in the unbind path; test module load/unload cycles under IRQ load.

Typical attack path

  1. Locate Linux system exposing ad_sigma_delta ADC hardware
  2. Obtain privileges sufficient to unbind or remove the device
  3. Trigger module unload or device removal while sampling is enabled
  4. Induce data-ready IRQ to execute handler on freed buffer

How to detect it

Review kernel logs for use-after-free or slab corruption oops mentioning ad_sigma_delta, ad_sd_trigger_handler, or samples_buf around device removal events.

What your security team should do

  • Prioritize kernel update on any system exposing the affected ADC driver
  • Monitor for oops or slab-use-after-free reports involving ad_sigma_delta
  • Restrict unprivileged access to device bind/unbind interfaces until patched

The record

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta: fix use-after-free on unbind ad_sd_buffer_postenable() allocates sigma_delta->samples_buf with devm_krealloc() at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources are released in reverse allocation order, which means unbind frees samples_buf before iio_device_unregister() disables the buffers and detaches the trigger pollfunc. The data ready IRQ is still enabled at that point, so ad_sd_trigger_handler() can still run and memcpy() incoming samples into the freed samples_buf. Fix this by preallocating the buffer in devm_ad_sd_setup_buffer_and_trigger(), before the triggered buffer and the IRQ are set up, so it is freed only after iio_device_unregister() has drained the trigger handler via free_irq(). Size it for the worst case of all sequencer slots being active; ad_sd_validate_scan_mask() already caps the number of active channels at num_slots. This issue was found by an in-house static analysis tool.

Affected packages

Ecosystem Package Introduced Fixed