CVE-2026-64501 Overview
CVE-2026-64501 is a Linux kernel vulnerability in the Industrial I/O (IIO) analog-to-digital converter (ADC) subsystem, specifically in the ad_sigma_delta driver. The flaw involves improper ordering of Serial Peripheral Interface (SPI) chip-select (CS) deassertion and bus lock release in ad_sigma_delta_single_conversion() and the error path of ad_sd_buffer_postenable(). The result is a leaked CS-asserted state and a stale bus_locked flag, which allows concurrent SPI access without the bus lock actually being held.
Critical Impact
A local attacker with access to the affected driver interfaces can corrupt device state and trigger concurrent SPI transactions, leading to data integrity loss and denial of service on systems using AD sigma-delta ADCs.
Affected Products
- Linux kernel builds including the iio/adc/ad_sigma_delta driver prior to the fixing commits
- Systems using AD sigma-delta ADC hardware with a physical CS line
- Downstream distributions shipping the vulnerable driver
Discovery Timeline
- 2026-07-25 - CVE-2026-64501 published to the National Vulnerability Database (NVD)
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-64501
Vulnerability Analysis
The vulnerability resides in the ad_sigma_delta IIO ADC driver in the Linux kernel. In ad_sigma_delta_single_conversion(), the driver invokes set_mode(AD_SD_MODE_IDLE) and disable_one() from the out: block while keep_cs_asserted is still true. Any SPI transfer issued by those callbacks carries the cs_change=1 flag, which leaves the chip-select line permanently asserted after the conversion completes.
A second defect exists in the error path of ad_sd_buffer_postenable(). If a call fails after set_mode(AD_SD_MODE_CONTINUOUS) succeeds (for example, spi_offload_trigger_enable()), the device remains in continuous-conversion mode with CS physically asserted. In addition, bus_locked stays true after spi_bus_unlock(), causing later SPI operations to call spi_sync_locked() without actually holding the bus lock.
Root Cause
The root cause is incorrect ordering of state cleanup relative to the keep_cs_asserted and bus_locked flags. Cleanup callbacks issue SPI transfers while these flags still indicate an active locked, CS-asserted session, so the transfers do not deassert CS and do not release the bus lock cleanly. This is a configuration and design flaw in the driver's teardown sequence combined with a race-condition surface on the SPI bus.
Attack Vector
Exploitation requires local access with privileges sufficient to interact with the IIO ADC interface or to trigger a failure in ad_sd_buffer_postenable(). A local attacker can drive the driver into the vulnerable cleanup path to leave the SPI bus with a stale lock state. Subsequent SPI operations from other drivers or userspace consumers can then execute concurrently on the shared bus without proper synchronization, compromising data integrity and availability.
No verified public exploit code is available. See the upstream commits for the corrected teardown sequence: Linux Kernel Commit c313bb7c, Linux Kernel Commit c72da068, and Linux Kernel Commit f1de829e.
Detection Methods for CVE-2026-64501
Indicators of Compromise
- SPI bus contention or unexpected spi_sync_locked() warnings in kernel logs on systems using AD sigma-delta ADCs.
- Sensor readings that appear stuck, corrupted, or inconsistent after an IIO buffer enable failure.
- Devices remaining in continuous-conversion mode after a failed ad_sd_buffer_postenable() call.
Detection Strategies
- Audit running kernel versions on Linux hosts against the fixing commits in the stable trees.
- Monitor dmesg and journal output for IIO or SPI subsystem warnings referencing ad_sigma_delta, spi_bus_unlock, or cs_change.
- Correlate hardware telemetry anomalies with driver initialization or buffer-enable failure events.
Monitoring Recommendations
- Track kernel package versions across Linux fleets and flag hosts running unpatched IIO ADC drivers.
- Alert on repeated SPI transfer failures or lock-order warnings from the kernel ring buffer.
- Baseline expected ADC sensor behavior and alert on sudden deviations in embedded and industrial deployments.
How to Mitigate CVE-2026-64501
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits c313bb7c, c72da068, and f1de829e.
- Update to a stable kernel release that incorporates the ad_sigma_delta fix from your distribution vendor.
- Restrict local access to IIO device nodes to trusted service accounts only.
Patch Information
The fix moves both set_mode(AD_SD_MODE_IDLE) and disable_one() into the out_unlock: block, after keep_cs_asserted is cleared, matching the pattern already used in ad_sd_calibrate(). The error path of ad_sd_buffer_postenable() is corrected to clear keep_cs_asserted first, call set_mode(AD_SD_MODE_IDLE) to revert the mode and deassert CS, then clear bus_locked before releasing the bus. Refer to Linux Kernel Commit c313bb7c, Linux Kernel Commit c72da068, and Linux Kernel Commit f1de829e.
Workarounds
- Disable or unload the ad_sigma_delta driver on systems that do not require AD sigma-delta ADC functionality.
- Tighten permissions on /dev/iio:device* nodes to prevent unprivileged access.
- For devices lacking a physical CS pin (such as MAX11205), no additional mitigation is required because the cs_change flag has no effect on any physical line.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
