CVE-2026-64500

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: lpc32xx: Initialize completion before requesting IRQ

In the report from Jaeyoung Chung:

"lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its

interrupt handler with devm_request_irq() before it initializes

st->completion with init_completion(). If an interrupt arrives after

devm_request_irq() and before init_completion(), the handler calls

complete() on an uninitialized completion, causing a kernel panic.

The probe path, in lpc32xx_adc_probe():

iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */

...

retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0,

LPC32XXAD_NAME, st); /* register handler */

...

init_completion(&st->completion); /* initialize completion */

lpc32xx_adc_isr() calls complete():

complete(&st->completion);

If the device raises an interrupt before init

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References