CVE-2026-64502: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64502 Overview

CVE-2026-64502 is a heap corruption vulnerability in the Linux kernel's Industrial I/O (IIO) subsystem, specifically within the ad_sigma_delta analog-to-digital converter (ADC) driver. The flaw resides in ad_sigma_delta_clear_pending_event(), which falls through to the status register read path for registerless devices that lack a rdy_gpiod. On affected devices, the function performs a memset(data + 2, 0xff, 0 - 1) operation, where the length underflows to SIZE_MAX, corrupting the kernel heap. A secondary path with rdy_gpiod set but num_resetclks = 0 reaches the same corrupting memset.

Critical Impact
Local low-privileged users interacting with affected IIO ADC devices can trigger kernel heap corruption, leading to potential privilege escalation, kernel memory disclosure, or denial of service.

Affected Products

Linux kernel IIO subsystem — drivers/iio/adc/ad_sigma_delta.c
Registerless ADC devices: ad7191, ad7780, max11205
Any device configured with rdy_gpiod set and num_resetclks = 0

Discovery Timeline

2026-07-25 - CVE-2026-64502 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64502

Vulnerability Analysis

The defect lives in the sigma-delta ADC driver logic that handles pending conversion events. When ad_sigma_delta_clear_pending_event() is invoked on a device with has_registers = false and no rdy_gpiod, execution falls through to ad_sd_read_reg(). That function skips the address byte and clocks raw MISO bytes, making the read byte-for-byte identical to a conversion data read. The driver partially consumes any pending conversion result, corrupting the data stream for the subsequent ad_sd_read_reg() call inside ad_sigma_delta_single_conversion().

The more serious failure occurs when num_resetclks = 0. Under this configuration, data_read_len evaluates to zero. If the clocked byte has bit 7 clear, pending_event is set and the driver executes memset(data + 2, 0xff, 0 - 1). The length argument underflows to SIZE_MAX, producing an out-of-bounds heap write of unbounded size.

Root Cause

The root cause is missing guard logic in ad_sigma_delta_clear_pending_event(). The function assumes a valid read length and a register-capable device, but neither condition holds for registerless devices with num_resetclks = 0. The arithmetic data_read_len - 1 performed as an unsigned computation wraps to SIZE_MAX, exposing a boundary-condition error [CWE-193, CWE-787] that corrupts the kernel heap.

Attack Vector

Exploitation requires local access with permissions to interact with the affected IIO device node under /sys/bus/iio or /dev/iio:deviceN. An attacker with low privileges triggers a single conversion request on a vulnerable registerless ADC. The subsequent clear_pending_event path reaches the underflowed memset, overwriting adjacent slab objects with 0xff bytes. Successful heap grooming can yield arbitrary kernel memory corruption and privilege escalation.

No verified public proof-of-concept code is available. See the upstream fix commits for technical details: Kernel Git Commit 3394e0b, Kernel Git Commit 3bceb26d, and Kernel Git Commit 91bc6767.

Detection Methods for CVE-2026-64502

Indicators of Compromise

Kernel log entries referencing SLUB/SLAB corruption, KASAN out-of-bounds write reports, or general protection faults originating from ad_sigma_delta_clear_pending_event or ad_sd_read_reg.
Unexpected kernel oops or panic traces on systems using ad7191, ad7780, or max11205 ADC hardware.
Anomalous reads or writes against /dev/iio:device* or /sys/bus/iio/devices/iio:device*/in_voltage*_raw from non-privileged processes.

Detection Strategies

Enable KASAN on test kernels to catch the out-of-bounds memset write triggered by data_read_len = 0.
Audit loaded IIO ADC driver modules with lsmod | grep -E 'ad7191|ad7780|max11205|ad_sigma_delta' and cross-reference against kernel version.
Correlate process activity accessing IIO device nodes with subsequent kernel error events in the same time window.

Monitoring Recommendations

Forward dmesg, journalctl -k, and /var/log/kern.log to a central data lake and alert on SLUB corruption, KASAN reports, and kernel oops signatures.
Monitor unprivileged process access to /dev/iio:device* paths using auditd rules on the open, read, and ioctl syscalls.
Track kernel module load events for ad_sigma_delta to inventory exposed systems.

How to Mitigate CVE-2026-64502

Immediate Actions Required

Apply the upstream fix commits 3394e0b3, 3bceb26d, and 91bc6767 or upgrade to a kernel release that includes them.
Inventory embedded, industrial, and IoT systems using ad7191, ad7780, or max11205 ADCs and prioritize them for patching.
Restrict access to /dev/iio:device* nodes to trusted service accounts using udev rules and filesystem permissions.

Patch Information

The fix returns 0 immediately from ad_sigma_delta_clear_pending_event() when neither rdy_gpiod nor has_registers is set, and adds an explicit data_read_len == 0 guard after the pending-event check to prevent the underflowed memset. Patch references: Kernel Git Commit 3394e0b, Kernel Git Commit 3bceb26d, Kernel Git Commit 91bc6767.

Workarounds

Unload the ad_sigma_delta module on systems where the affected ADCs are not required: modprobe -r ad_sigma_delta.
Blacklist the driver via /etc/modprobe.d/ on systems that cannot be patched immediately.
Tighten permissions on IIO device nodes so only privileged system services can issue conversion requests.

bash

# Configuration example: blacklist the vulnerable driver and restrict IIO device access
echo 'blacklist ad_sigma_delta' | sudo tee /etc/modprobe.d/blacklist-ad-sigma-delta.conf
sudo depmod -a

# Restrict IIO device node access via udev
cat <<'EOF' | sudo tee /etc/udev/rules.d/90-iio-restrict.rules
KERNEL=="iio:device*", MODE="0600", OWNER="root", GROUP="root"
EOF
sudo udevadm control --reload-rules && sudo udevadm trigger