PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46282 Linux CVE debrief

A NULL pointer dereference vulnerability was found in the Linux kernel's iio: frequency: admv1013 driver. When device_property_read_string() fails, the code falls through to strcmp(), dereferencing a garbage pointer. This issue has been resolved by replacing manual read/strcmp with device_property_match_property_string().

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Linux kernel users and administrators

Technical summary

The Linux kernel's iio: frequency: admv1013 driver is vulnerable to a NULL pointer dereference. The issue arises when device_property_read_string() fails, leaving the 'str' variable uninitialized. The code then attempts to compare 'str' using strcmp(), which can lead to a garbage pointer dereference.

Defensive priority

High

Recommended defensive actions

  • Apply the patches provided in the kernel.org references
  • Use device_property_match_property_string() to safely match property strings

Evidence notes

The CVE record and NVD detail pages provide information on this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46282 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46282

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46282 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46282

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2dc8d26690bf4e7226409563221c37bc095c94ff

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3a9d8ec2051c2d80158ed7bded5e158c42870037

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5e9f1bad26df3d3afb3cbbfa408b6d6e809708ac

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/aac0a51b16700b403a55b67ba495de021db78763

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.