CVE-2026-46282: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46282 Overview

CVE-2026-46282 is a NULL pointer dereference vulnerability in the Linux kernel's Industrial I/O (IIO) frequency driver admv1013. The flaw occurs when device_property_read_string() fails and leaves the str variable uninitialized. Subsequent code falls through to a strcmp(str, ...) call, dereferencing a garbage pointer. The upstream fix replaces the manual read and string comparison with device_property_match_property_string() and consolidates the SE mode enumerations into a single sequential enum mapped to hardware register values via a switch statement.

Critical Impact
Local triggering of the uninitialized pointer dereference can cause a kernel oops or panic, resulting in denial of service on systems probing an admv1013 device with malformed firmware properties.

Affected Products

Linux kernel — drivers/iio/frequency/admv1013 driver
Stable kernel branches receiving the backport (see referenced git commits)
Systems with Analog Devices ADMV1013 upconverter hardware enabled in IIO

Discovery Timeline

2026-06-08 - CVE-2026-46282 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-46282

Vulnerability Analysis

The defect resides in the probe path of the admv1013 IIO frequency driver. The driver calls device_property_read_string() to retrieve a single-ended (SE) mode property from firmware. When that helper returns an error, the destination pointer str is never assigned a valid value. The control flow does not branch on the error, so execution proceeds to strcmp(str, ...), which dereferences uninitialized stack memory.

Dereferencing the garbage pointer typically triggers a kernel Oops and aborts the probe sequence. On systems where the driver is built-in or auto-loaded during boot, the fault can prevent successful initialization of dependent subsystems. This class of defect is tracked as Null Pointer Dereference and Uninitialized Memory Use [CWE-476, CWE-457].

Root Cause

The root cause is missing error handling around device_property_read_string(). The driver assumed the property would always be present and readable, omitting the guard that returns or branches on a non-zero return code. Because str is a local pointer with no initializer, its contents after a failed read are indeterminate.

Attack Vector

Exploitation requires the ability to influence the device firmware properties consumed by the driver, for example through a malformed ACPI table, device tree overlay, or hardware configuration on a system that loads admv1013. The result is a local denial of service via kernel crash. No remote attack vector is documented and no public exploit is available.

The vulnerability is described in the upstream commits referenced below. See the kernel.org commit replacing the manual read pattern for the corrected logic.

Detection Methods for CVE-2026-46282

Indicators of Compromise

Kernel Oops or BUG: unable to handle kernel NULL pointer dereference messages referencing admv1013 symbols in dmesg or journalctl -k.
Failed module load entries for admv1013 accompanied by stack traces involving strcmp and device_property_read_string.
Probe failure events for IIO frequency devices on hosts with ADMV1013 hardware.

Detection Strategies

Inventory running kernel versions against the fixed commits listed in the NVD references to identify unpatched hosts.
Parse kernel log streams for crash signatures that include admv1013_probe in the backtrace.
Audit device tree sources and ACPI tables on affected platforms for missing or malformed SE mode string properties.

Monitoring Recommendations

Forward kern.crit and kern.err syslog facilities to a centralized log platform and alert on kernel oops patterns.
Track unexpected reboots and probe failures on Linux hosts that integrate Analog Devices RF hardware.
Correlate driver load failures with recent firmware or device tree updates to attribute root cause.

How to Mitigate CVE-2026-46282

Immediate Actions Required

Apply the stable kernel update that includes the fix commits referenced in the NVD entry.
Where patching is not immediate, blacklist the admv1013 module on systems that do not require the hardware.
Validate firmware-provided IIO properties for completeness before deploying updated device trees or ACPI tables.

Patch Information

The upstream fix replaces the manual device_property_read_string() plus strcmp() pattern with device_property_match_property_string() and consolidates SE mode enumerations. Stable backports are tracked in the following commits:

The NVD entry notes that recent cleanup patches on this driver require a manual backport for older stable trees.

Workarounds

Prevent the affected driver from loading on systems lacking ADMV1013 hardware by adding blacklist admv1013 to /etc/modprobe.d/.
Ensure the firmware-supplied SE mode property is present and well-formed before binding the driver.
Restrict local administrative access that could trigger reprobing with attacker-controlled device tree overlays.

bash

# Configuration example: prevent the vulnerable driver from auto-loading
echo 'blacklist admv1013' | sudo tee /etc/modprobe.d/cve-2026-46282.conf
sudo depmod -a
sudo update-initramfs -u