CVE-2026-63933: Linux Kernel ADIS16260 DoS Vulnerability

CVE-2026-63933 Overview

CVE-2026-63933 is a division-by-zero vulnerability in the Linux kernel's Industrial I/O (IIO) subsystem, specifically in the adis16260 gyroscope driver. The flaw resides in the write_raw handler, which fails to validate the sampling frequency value supplied by userspace before using it as a divisor. A local user with write access to the sampling_frequency sysfs attribute can trigger the fault by writing zero to that attribute. The resulting division-by-zero causes a kernel-level fault. The vulnerability has been resolved upstream through multiple stable-tree backports.

Critical Impact
A local user writing zero to the sampling_frequency sysfs attribute triggers a kernel division-by-zero, causing a denial-of-service condition on systems using the adis16260 gyroscope driver.

Affected Products

Linux kernel iio subsystem — adis16260 gyroscope driver
Multiple stable kernel branches receiving the backport (see referenced commits)
Systems exposing the sampling_frequency sysfs attribute for the adis16260 device

Discovery Timeline

2026-07-19 - CVE-2026-63933 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63933

Vulnerability Analysis

The adis16260 driver is part of the Linux kernel's IIO subsystem and supports Analog Devices ADIS16260 digital gyroscope sensors. The driver exposes a sampling_frequency sysfs attribute that userspace can write to in order to configure the sensor's output data rate.

Inside the write_raw implementation, the driver uses the user-supplied sampling frequency as a divisor when computing an internal rate configuration register value. The code path does not verify that the supplied value is non-zero. Writing 0 to the attribute causes the divide instruction to fault at kernel privilege level, producing a kernel oops and denial of service.

The fix adds a validation check that rejects zero (and other invalid) values before performing the division, ensuring the driver returns an error to userspace instead of faulting.

Root Cause

The root cause is missing input validation on a userspace-controlled integer that flows directly into a division operation inside a kernel driver. The write_raw callback accepts a value from the sampling_frequency sysfs write and passes it as the divisor without bounds checking. This is a classic missing-sanitization defect in a device driver ioctl-equivalent interface (Improper Input Validation).

Attack Vector

Exploitation requires local access to the target system and permission to write to the affected sysfs node under /sys/bus/iio/devices/iio:deviceN/. Systems typically restrict this path to root or a privileged group, so the practical impact is limited to a local privileged denial-of-service. On systems where the sysfs attribute is exposed to unprivileged users through custom udev rules or group permissions, an unprivileged local user could crash the kernel by writing 0 to the attribute.

No verified public exploit code is available. The vulnerability is described in the upstream commit messages referenced in the kernel stable tree.

Detection Methods for CVE-2026-63933

Indicators of Compromise

Kernel oops or panic messages referencing divide error originating from adis16260_write_raw or the surrounding call path in the IIO subsystem
Unexpected system reboots or crashes on hosts equipped with the ADIS16260 gyroscope hardware
Audit or shell history entries showing writes of 0 to sampling_frequency under /sys/bus/iio/devices/

Detection Strategies

Monitor dmesg and /var/log/kern.log for divide_error traces referencing adis16260 or IIO gyro symbols
Enable Linux Audit Framework rules on sysfs paths under /sys/bus/iio/devices/ to log write attempts against sampling_frequency
Inventory hosts running affected kernel versions and cross-reference against hardware inventory to identify systems physically equipped with the ADIS16260 sensor

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on divide_error and Oops events tied to IIO drivers
Track kernel version and patch level across the fleet to confirm coverage of the referenced stable-tree fixes
Alert on unexpected process activity writing to IIO sysfs attributes, particularly from non-administrative accounts

How to Mitigate CVE-2026-63933

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable-tree commits, including commit aa8a5e11 and the additional backports listed in the NVD references
Update to a distribution kernel package that includes the fix once your vendor publishes it
Restrict write access to IIO sysfs attributes to root-only where custom permissions have relaxed defaults

Patch Information

The fix adds a validation check for the sampling frequency value before using it as a divisor in adis16260_write_raw. Upstream commits addressing the issue include 19eb8565, 59f80b94, 5a42e396, 761e8b48, 86298fb6, aa8a5e11, aaf9d640, and d2b83995, covering multiple stable branches.

Workarounds

Unload the adis16260 kernel module on systems that do not require gyroscope functionality using modprobe -r adis16260
Blacklist the module by adding blacklist adis16260 to /etc/modprobe.d/blacklist-adis16260.conf on hosts where the sensor is not in use
Tighten permissions on the affected sysfs attribute so that only root can write to sampling_frequency under /sys/bus/iio/devices/iio:deviceN/

bash

# Verify the module is loaded and inspect current permissions
lsmod | grep adis16260
ls -l /sys/bus/iio/devices/iio:device*/sampling_frequency

# Temporary mitigation: unload the driver if the sensor is unused
sudo modprobe -r adis16260

# Persistent mitigation: blacklist the module
echo 'blacklist adis16260' | sudo tee /etc/modprobe.d/blacklist-adis16260.conf