CVE-2026-98677

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: ad_sigma_delta: fix use-after-free on unbind

ad_sd_buffer_postenable() allocates sigma_delta->samples_buf with

devm_krealloc() at runtime, so its devres entry sits after all

probe-time entries of the driver. devm resources are released in

reverse allocation order, which means unbind frees samples_buf before

iio_device_unregister() disables the buffers and detaches the trigger

pollfunc. The data ready IRQ is still enabled at that point, so

ad_sd_trigger_handler() can still run and memcpy() incoming samples

into the freed samples_buf.

Fix this by preallocating the buffer in

devm_ad_sd_setup_buffer_and_trigger(), before the triggered buffer and

the IRQ are set up, so it is freed only after iio_device_unregister()

has drained the trigger handler via free_irq(). Size it for the worst

case of all sequencer slots being active; ad_sd_validate_scan_mask()

already caps the number of active channels at num_slots.

Th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References