CVE-2026-64500 Overview
CVE-2026-64500 is a race condition in the Linux kernel's Industrial I/O (IIO) subsystem, specifically in the lpc32xx_adc driver at drivers/iio/adc/lpc32xx_adc.c. The lpc32xx_adc_probe() function registers an interrupt handler with devm_request_irq() before initializing the completion structure with init_completion(). If a spurious interrupt fires between these two calls, the handler invokes complete() on an uninitialized completion object. This causes dereference of a NULL list entry inside swake_up_locked(), resulting in a kernel panic detected by KASAN as a wild-memory-access.
Critical Impact
A spurious interrupt during driver probe can trigger a kernel panic through an uninitialized synchronization primitive, causing denial of service on affected embedded systems.
Affected Products
- Linux kernel builds including the lpc32xx_adc IIO driver (NXP LPC32xx SoC ADC)
- Embedded Linux distributions targeting LPC32xx ARM platforms
- Downstream kernels that have not backported the fix commits
Discovery Timeline
- 2026-07-25 - CVE-2026-64500 published to the National Vulnerability Database (NVD)
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64500
Vulnerability Analysis
The defect is a race condition [Race Condition] in the probe path of the lpc32xx_adc driver. The driver allocates its state structure st via devm_iio_device_alloc(), which returns kzalloc-zeroed memory. It then registers lpc32xx_adc_isr as an interrupt handler using devm_request_irq(). Only after IRQ registration does the driver call init_completion(&st->completion) to prepare the completion primitive.
Between these two operations, the ADC hardware can raise an interrupt. When lpc32xx_adc_isr() runs, it calls complete(&st->completion). Because the completion is still zero-filled, complete() acquires an uninitialized wait.lock and traverses a zeroed task_list. The zeroed head causes list_empty() to return false, so swake_up_locked() dereferences an invalid list entry and the kernel panics.
Root Cause
The root cause is incorrect ordering of initialization operations during driver probe. Synchronization primitives touched from interrupt context must be fully initialized before the interrupt source becomes live. Registering the handler before init_completion() violates this ordering requirement.
Attack Vector
Triggering the flaw requires either the hardware raising a spurious ADC interrupt during the probe window or an attacker with physical or privileged access influencing IRQ delivery on the LPC32xx SoC. Exploitation is limited to denial of service through kernel panic. No remote or unprivileged user-space vector is documented in the report.
The upstream fix reorders the two calls so that init_completion(&st->completion) runs before devm_request_irq(), eliminating the vulnerable window. See the kernel git commit e561b35 for the reference patch.
Detection Methods for CVE-2026-64500
Indicators of Compromise
- Kernel panic messages referencing swake_up_locked() or complete() originating from lpc32xx_adc_isr
- KASAN reports flagging wild-memory-access inside the IIO ADC probe path on LPC32xx hardware
- Unexplained boot-time crashes on devices using the lpc32xx_adc driver
Detection Strategies
- Audit kernel build configurations for CONFIG_LPC32XX_ADC on affected LPC32xx targets and verify the patch is applied
- Enable KASAN and lockdep on development builds to catch uninitialized-primitive access during probe
- Compare running kernel commit hashes against the fix commits listed in the NVD references
Monitoring Recommendations
- Collect and centralize dmesg and kmsg output from embedded fleet devices to identify panic signatures
- Monitor device reboot rates on LPC32xx-based hardware for anomalies indicating repeated probe-time panics
- Track kernel package versions across managed embedded systems to confirm the fix is deployed
How to Mitigate CVE-2026-64500
Immediate Actions Required
- Update to a Linux kernel version that includes the fix commits referenced in the NVD advisory
- For custom or vendor kernels, backport the reordering patch that moves init_completion() before devm_request_irq() in lpc32xx_adc_probe()
- Rebuild and redeploy firmware images for LPC32xx devices after applying the patch
Patch Information
The fix has been merged into multiple stable branches. Reference commits include 0e33587, 1ddf7b6, 2f18c55, 48eccc6, 7090c0d, 820c4f1, 9e2e8b8, and e561b35.
Workarounds
- Disable the lpc32xx_adc driver in the kernel configuration if ADC functionality is not required on the deployed hardware
- Blacklist or unbind the driver at runtime on systems where ADC input is not used
- Restrict physical access to affected embedded devices to reduce opportunity for triggering spurious interrupts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
