CVE-2026-98666 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of the iio: gyro: adis16136 driver, should assess their exposure and verify if their systems are affected by this vulnerability.

Why it matters

This vulnerability in the Linux kernel's iio: gyro: adis16136 driver allows for unprotected debugfs reads, which can lead to issues when debugfs_remove_recursive() is called. Linux kernel developers and maintainers should assess their exposure and verify if their systems are affected.

• Verify if the Linux kernel version is affected and apply patches if necessary.
• Monitor the system for potential issues related to the iio: gyro: adis16136 driver.
• Review and update the Linux kernel configuration to ensure debugfs is properly configured.

Technical summary

The Linux kernel's iio: gyro: adis16136 driver has a vulnerability that allows for unprotected debugfs reads. The serial_number file operations are open-coded and do not call debugfs_file_get(), which is required by debugfs_create_file_unsafe(). This can lead to issues when debugfs_remove_recursive() is called, as it does not wait for a read in progress, and unbind frees the iio_dev underneath it.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel's iio: gyro: adis16136 driver.
• Verify the Linux kernel version and check if the patch is applied.
• Monitor the system for any potential issues related to the iio: gyro: adis16136 driver.
• Perform a thorough review of system configurations and ensure that debugfs is properly configured.
• Conduct an asset inventory to identify systems that may be affected by this vulnerability.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets to ensure the vulnerability is fully resolved.

Evidence notes

The CVE record and NVD entry provide information on the vulnerability, but details on affected versions, exploitation, and remediation are limited. Further verification is required from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.