CVE-2026-98664: Linux Kernel ADIS16400 Use-After-Free

CVE-2026-98664 Overview

CVE-2026-98664 is a use-after-free vulnerability in the Linux kernel's adis16400 Inertial Measurement Unit (IMU) driver. The flaw resides in the adis16400_serial_number_fops debugfs file operations, which are open-coded and never invoke debugfs_file_get(). As a result, debugfs_remove_recursive() does not wait for an in-progress read to complete during driver unbind. The underlying iio_dev structure can be freed while a userspace reader still holds a reference, producing a use-after-free condition in the Industrial I/O (IIO) subsystem.

Critical Impact
A local user reading the serial_number debugfs file concurrently with a driver unbind can trigger a use-after-free on the iio_dev object, risking kernel memory corruption or a system crash.

Affected Products

Linux kernel builds containing the adis16400 IIO IMU driver
Kernel branches prior to the commits listed in the patch references
Systems exposing /sys/kernel/debug/iio/* to privileged local users with the adis16400 driver loaded

Discovery Timeline

2026-10-18 - CVE-2026-98664 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98664

Vulnerability Analysis

The adis16400 driver exposes several debugfs entries, including product_id, flash_count, and serial_number. A prior refactor (commit ae1d37a9bb4b) converted product_id and flash_count to DEFINE_DEBUGFS_ATTRIBUTE, which internally handles reference counting through debugfs_file_get(). However, that same change moved all three files to debugfs_create_file_unsafe().

The serial_number file cannot use DEFINE_DEBUGFS_ATTRIBUTE because it prints three device registers formatted as "%.4x-%.4x-%.4x", whereas DEFINE_DEBUGFS_ATTRIBUTE formats only a single u64 value. Because the open-coded file operations never call debugfs_file_get(), debugfs_remove_recursive() returns without waiting for active readers. If a driver unbind occurs during a concurrent read, the iio_dev backing the file is freed while the read handler still dereferences it.

Root Cause

The root cause is a missing reference-count acquisition between an open-coded debugfs read handler and the debugfs removal path. Using debugfs_create_file_unsafe() without pairing it with debugfs_file_get()/debugfs_file_put() breaks the ordering contract that normally keeps the backing object alive for the duration of a read.

Attack Vector

Exploitation requires local access and the ability to read debugfs, which is typically restricted to privileged users. An attacker races a read of the serial_number debugfs file against a driver unbind operation (for example, via /sys/bus/.../unbind or hot-plug removal). Winning the race causes the kernel to operate on freed memory, which can lead to a kernel crash or memory corruption depending on how the freed slab is reallocated. See the upstream fix referenced in Kernel Patch Update 50e8d70b for the exact code transition from debugfs_create_file_unsafe() to debugfs_create_file().

Detection Methods for CVE-2026-98664

Indicators of Compromise

Kernel oops or BUG: KASAN: use-after-free reports referencing adis16400_show_serial_number or neighboring IIO symbols
Unexpected kernel panics correlated with device unbind events on systems using Analog Devices IMU hardware
Unprivileged attempts to script repeated reads of /sys/kernel/debug/iio/*/serial_number alongside unbind operations

Detection Strategies

Enable KASAN on test kernels to surface use-after-free accesses in the IIO debugfs read path
Audit kernel versions against the fixed commits (50e8d70b, d3078aae, d9478728, e9b4c00f, f501302e) using package or build metadata
Monitor /sys/bus/iio/drivers/adis16400/unbind write events and correlate with concurrent debugfs reads in audit logs

Monitoring Recommendations

Forward dmesg and kern.log entries containing KASAN, use-after-free, or adis16400 strings into a centralized logging pipeline for triage
Alert on crash-dump artifacts (vmcore, kdump) produced on IMU-equipped hosts
Track process execution of debugfs consumers under non-root service accounts to detect anomalous enumeration

How to Mitigate CVE-2026-98664

Immediate Actions Required

Apply the upstream Linux kernel patches that convert adis16400 debugfs files back to debugfs_create_file()
Restrict mount and read permissions on debugfs so only trusted administrators can access /sys/kernel/debug
Avoid runtime unbind of the adis16400 driver on production systems until patched kernels are deployed

Patch Information

The fix replaces debugfs_create_file_unsafe() with debugfs_create_file() for the open-coded serial_number file in the adis16400 driver, matching the pattern already used by the adis16475 and adis16550 drivers. Backported fixes are available in the stable tree:

Workarounds

Unload the adis16400 module on systems where the IMU is not required
Remount debugfs with stricter permissions, or disable it entirely in kernels that permit CONFIG_DEBUG_FS=n
Prevent non-root users from writing to /sys/bus/iio/drivers/adis16400/unbind through standard filesystem permissions

bash

# Configuration example
# Restrict debugfs access to root only and prevent casual exposure
mount -o remount,mode=0700 /sys/kernel/debug

# Unload the vulnerable driver if the IMU is unused
modprobe -r adis16400