CVE-2026-98666: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98666 Overview

CVE-2026-98666 affects the Linux kernel's Industrial I/O (IIO) subsystem, specifically the adis16136 gyroscope driver. The serial_number debugfs file uses open-coded file operations that never call debugfs_file_get(), a prerequisite for files created with debugfs_create_file_unsafe(). As a result, debugfs_remove_recursive() does not wait for an in-progress read to finish. When the device is unbound, the iio_dev structure is freed while a reader still references it, creating a use-after-free condition. The upstream fix replaces the unsafe helper with debugfs_create_file().

Critical Impact
A local user able to read the driver's debugfs serial_number file concurrently with device unbind can trigger a use-after-free of the iio_dev object in kernel memory.

Affected Products

Linux kernel builds containing the iio-gyro-adis16136 driver prior to the fix
Distributions shipping stable kernel branches that include the affected adis16136 debugfs code path
Systems exposing IIO debugfs entries to local users on devices using the ADIS16136 gyroscope

Discovery Timeline

2026-10-18 - CVE-2026-98666 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98666

Vulnerability Analysis

The adis16136 IIO driver exposes a serial_number entry under debugfs for diagnostic access. The entry is registered with debugfs_create_file_unsafe(), which pushes the lifetime-management responsibility to the file operations. Safe handling requires each read/write callback to call debugfs_file_get() on entry and debugfs_file_put() on exit, so that debugfs_remove_recursive() blocks until outstanding operations complete.

The driver's open-coded read handler skips this protocol entirely. During device unbind, the IIO core proceeds to tear down and free the iio_dev while a concurrent reader still holds a pointer to driver state derived from it. The reader then dereferences freed memory, producing a classic use-after-free in kernel context. The upstream patch switches registration to debugfs_create_file(), which internally serializes removal against readers and eliminates the race.

Root Cause

The root cause is incorrect use of the debugfs_create_file_unsafe() API without implementing the required debugfs_file_get()/debugfs_file_put() reference protocol inside the file operation callbacks. This breaks the removal barrier that debugfs relies on to synchronize unbind with active readers.

Attack Vector

Exploitation requires local access with permission to read the IIO driver's debugfs serial_number file, and the ability to trigger or race with device unbind. An attacker races a sustained read of serial_number against an unbind of the adis16136 device. If timed correctly, the kernel frees the backing iio_dev while the read handler is still dereferencing it, leading to memory corruption or kernel panic. The practical impact is kernel memory corruption and denial of service, with potential for further escalation depending on allocator state and kernel hardening features.

No verified public exploit code is available for this vulnerability. See the upstream commits referenced below for the exact code paths involved.

Detection Methods for CVE-2026-98666

Indicators of Compromise

Kernel oops or panic traces referencing adis16136 functions or IIO core teardown paths following debugfs reads
KASAN use-after-free reports naming iio_dev allocations freed during device unbind
Unexpected driver unbind events on hosts exposing ADIS16136 gyroscope hardware

Detection Strategies

Enable CONFIG_KASAN on test and staging kernels to catch the use-after-free when racing reads with unbind
Audit running kernel versions against the fixed commits (2b498df, b05e768, b53dc6e, b62c394, d5b0b62) to identify unpatched systems
Monitor /sys/kernel/debug/iio/ access patterns and correlate with bind/unbind events on IIO devices

Monitoring Recommendations

Forward kernel ring buffer messages (dmesg, /var/log/kern.log) to a central log platform and alert on oops, BUG, or KASAN entries
Track auditd events for writes to /sys/bus/iio/drivers/adis16136/unbind and reads from the driver's debugfs entries
Inventory hosts with the adis16136 module loaded (lsmod | grep adis16136) to scope exposure

How to Mitigate CVE-2026-98666

Immediate Actions Required

Apply the upstream Linux kernel patch that replaces debugfs_create_file_unsafe() with debugfs_create_file() in the adis16136 driver
Update to a stable kernel release that includes one of the fix commits referenced by the Linux kernel maintainers
Restrict access to /sys/kernel/debug to root only by ensuring debugfs is mounted with mode 0700

Patch Information

The fix is distributed across the following stable kernel commits: Kernel Git Commit 2b498df, Kernel Git Commit b05e768, Kernel Git Commit b53dc6e, Kernel Git Commit b62c394, and Kernel Git Commit d5b0b62. Rebuild and deploy kernels incorporating these commits across affected branches.

Workarounds

Unmount debugfs on production systems where kernel diagnostics are not required (umount /sys/kernel/debug)
Blacklist the adis16136 module on hosts that do not use the ADIS16136 gyroscope hardware
Enforce strict permissions on debugfs so that non-root users cannot open the serial_number file

bash

# Configuration example
# Restrict debugfs to root and blacklist the vulnerable module where unused
mount -o remount,mode=700 /sys/kernel/debug
echo 'blacklist adis16136' > /etc/modprobe.d/blacklist-adis16136.conf
lsmod | grep -q adis16136 && rmmod adis16136