CVE-2026-98677 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of the affected Linux kernel versions should review and apply the provided kernel patches to fix the vulnerability. Additionally, system administrators and security teams should verify that the Linux kernel version is compatible with the system's configuration and monitor system logs for potential crashes or data corruption related to the iio: adc: ad_sigma_delta driver.

Why it matters

A use-after-free vulnerability in the Linux kernel's iio: adc: ad_sigma_delta driver can cause a potential system crash or data corruption. Linux kernel developers and maintainers, Linux distribution maintainers, and users of the affected Linux kernel versions should review and apply the provided kernel patches to fix the vulnerability.

• Potential system crash or data corruption due to use-after-free vulnerability
• Need to verify and apply kernel patches to prevent exploitation
• Required review of system logs for potential crashes or data corruption related to the iio: adc: ad_sigma_delta driver

Technical summary

The vulnerability is caused by the devm resources being released in reverse allocation order, which means unbind frees samples_buf before iio_device_unregister() disables the buffers and detaches the trigger pollfunc. The data ready IRQ is still enabled at that point, allowing ad_sd_trigger_handler() to run and memcpy() incoming samples into the freed samples_buf. The fix involves preallocating the buffer in devm_ad_sd_setup_buffer_and_trigger(), before the triggered buffer and the IRQ are set up, so it is freed only after iio_device_unregister() has drained the trigger handler via free_irq().

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to fix the vulnerability
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor system logs for potential crashes or data corruption related to the iio: adc: ad_sigma_delta driver
• Verify that the Linux kernel version is compatible with the system's configuration
• Check for any potential issues with the iio: adc: ad_sigma_delta driver
• Review system logs for potential crashes or data corruption related to the iio: adc: ad_sigma_delta driver
• Perform a thorough review of the system's configuration and kernel version

Evidence notes

The vulnerability was found by an in-house static analysis tool. The issue is caused by the devm resources being released in reverse allocation order, which means unbind frees samples_buf before iio_device_unregister() disables the buffers and detaches the trigger pollfunc.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.