CVE-2026-64602 Overview
CVE-2026-64602 is a Linux kernel vulnerability in the SPEAr ADC driver at drivers/iio/adc/spear_adc.c. The spear_adc_probe() function registers an interrupt handler with devm_request_irq() before initializing the completion structure with init_completion(). An interrupt arriving in this window causes the handler to invoke complete() on an uninitialized completion, resulting in a kernel panic through a KASAN wild-memory-access. The issue was reported by Jaeyoung Chung and resolved by moving init_completion() above devm_request_irq() in the probe path.
Critical Impact
A spurious interrupt during driver probe dereferences an uninitialized completion structure, triggering a kernel panic and denial of service on affected Linux systems using the SPEAr Industrial I/O ADC driver.
Affected Products
- Linux kernel (mainline) — drivers/iio/adc/spear_adc.c
- Stable branches referenced by multiple backport commits on git.kernel.org
- Systems using the SPEAr ADC industrial I/O driver
Discovery Timeline
- 2026-08-06 - CVE CVE-2026-64602 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-64602
Vulnerability Analysis
The vulnerability is a race condition and uninitialized memory use [CWE-908] in the SPEAr ADC driver probe path. The driver allocates its state structure st using devm_iio_device_alloc(), which zero-initializes the memory. The probe function then registers the interrupt service routine spear_adc_isr via devm_request_irq() before calling init_completion(&st->completion). Between these two operations, the handler is armed but the completion structure remains zeroed rather than properly initialized.
If the hardware asserts an interrupt in this window, spear_adc_isr() calls complete(&st->completion). The complete() routine acquires the uninitialized wait.lock and traverses the zeroed task_list inside swake_up_locked(). Because the list head is zeroed rather than self-referential, list_empty() returns false, and the kernel dereferences a NULL list entry.
Root Cause
The root cause is ordering. The probe function makes the IRQ live before the data structure it targets is initialized. Kernel completion primitives require init_completion() to establish a valid wait.lock spinlock and a self-referential task_list before any concurrent access. The zero-initialization from devm_iio_device_alloc() is insufficient for these invariants.
Attack Vector
The defect is triggered locally on hardware where the SPEAr ADC device is present and can raise an interrupt during driver load. Exploitation requires the device to assert an IRQ line before probe completes, which is a timing-dependent condition rather than a network-reachable flaw. The observed impact is a kernel panic and denial of service on the affected system.
See the upstream fixes on git.kernel.org for the exact reordering applied across stable branches, including commits 37077d82 and a5075739.
Detection Methods for CVE-2026-64602
Indicators of Compromise
- Kernel panic messages referencing complete(), swake_up_locked(), or spear_adc_isr during boot or module load.
- KASAN reports flagging a wild-memory-access originating in the SPEAr ADC probe path.
- Unexpected reboots on SPEAr-based embedded platforms shortly after ADC device initialization.
Detection Strategies
- Compare running kernel versions against the fixed commits listed in the NVD references for the iio/adc/spear_adc.c file.
- Enable KASAN and lockdep in test builds to surface uninitialized completion access during driver probe.
- Audit build configurations for CONFIG_IIO and SPEAr platform support to identify at-risk devices.
Monitoring Recommendations
- Collect kernel crash dumps and dmesg output from embedded fleets and centralize them for triage.
- Alert on repeated boot failures or panic strings that mention IIO ADC subsystem symbols.
- Track kernel patch levels across managed Linux endpoints to confirm the fix is deployed.
How to Mitigate CVE-2026-64602
Immediate Actions Required
- Update to a Linux kernel release that includes the reordering of init_completion() before devm_request_irq() in spear_adc_probe().
- Rebuild custom or vendor kernels from stable branches after cherry-picking the referenced commits.
- Prioritize patching on SPEAr-based embedded systems that expose the ADC device to active interrupt sources.
Patch Information
The fix moves init_completion(&st->completion) above devm_request_irq() in spear_adc_probe(), ensuring the completion is fully initialized before the interrupt handler can run. Backport commits are available on git.kernel.org for multiple stable branches, including 3ee2128b, 67a49ab4, aea8ae6c, bbfebae4, eb5b07c9, and f3f90bc7.
Workarounds
- Blacklist the spear_adc module on systems that do not require ADC functionality until a patched kernel is deployed.
- Disable CONFIG_SPEAR_ADC in custom kernel builds where the driver is not needed.
- Restrict physical or peripheral access to devices that could induce spurious IRQs on the ADC line during boot.
# Blacklist the vulnerable driver until patching is complete
echo 'blacklist spear_adc' | sudo tee /etc/modprobe.d/blacklist-spear-adc.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
