CVE-2026-64502

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices

ad_sigma_delta_clear_pending_event() falls through to the status register

read path for devices with has_registers = false and no rdy_gpiod. For

such devices, ad_sd_read_reg() skips the address byte entirely and clocks

raw MISO bytes with no address phase — making it byte-for-byte identical

to reading conversion data. If a pending conversion result is present,

this partially consumes it and corrupts the data stream for the subsequent

ad_sd_read_reg() call in ad_sigma_delta_single_conversion().

Furthermore, with num_resetclks = 0 on these devices, data_read_len

evaluates to 0. If the clocked byte has bit 7 clear, pending_event is set

and the code attempts memset(data + 2, 0xff, 0 - 1), overflowing to

SIZE_MAX and corrupting the heap.

Fix by returning 0 immediately when neither rdy_gpiod nor has_registers

is set. This is safe for all current r

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References