CVE-2026-98664

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iio: imu: adis16400: fix unprotected debugfs reads

adis16400_serial_number_fops is open coded and never calls

debugfs_file_get(), so debugfs_remove_recursive() does not wait for a

read in progress and unbind frees the iio_dev underneath it.

Commit ae1d37a9bb4b ("iio: imu: adis16400: use DEFINE_DEBUGFS_ATTRIBUTE

instead of DEFINE_SIMPLE_ATTRIBUTE") converted product_id and

flash_count to DEFINE_DEBUGFS_ATTRIBUTE, which protects itself, but

moved all three files to debugfs_create_file_unsafe().

serial_number prints three registers as "%.4x-%.4x-%.4x" and

DEFINE_DEBUGFS_ATTRIBUTE() formats a single u64, so it cannot be

converted without changing what the file returns. adis16475 and

adis16550 already use debugfs_create_file() for their open coded

files. Use it here too.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References