CVE-2026-98668 Overview
CVE-2026-98668 is an uninitialized memory disclosure vulnerability in the Linux kernel's Industrial I/O (IIO) subsystem. The flaw resides in the iio_push_to_buffers_with_ts_unaligned() function, which handles buffered sensor data when a timestamp is appended. When the caller passes data whose length is not a multiple of 8 bytes, the kernel allocates a bounce buffer without zeroing it. The resulting padding bytes contain stale heap contents that are copied to the IIO buffer and ultimately readable from userspace.
Critical Impact
Local userspace readers of an IIO character device can obtain uninitialized kernel heap memory, which may contain sensitive data from other kernel allocations.
Affected Products
- Linux kernel versions containing iio_push_to_buffers_with_ts_unaligned() prior to the fix
- Distributions shipping the IIO subsystem with timestamp-enabled sensor drivers
- Embedded and IoT systems relying on IIO buffered sensor channels
Discovery Timeline
- 2026-10-18 - CVE-2026-98668 published to NVD
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-98668
Vulnerability Analysis
The Industrial I/O (IIO) subsystem exposes sensor data to userspace through character devices and buffered channels. When a driver calls iio_push_to_buffers_with_ts_unaligned(), the helper copies the incoming sample into a bounce buffer, appends an 8-byte timestamp, and pushes the result to the IIO ring buffer. The bounce buffer is allocated and resized with devm_krealloc(). Because __GFP_ZERO was not specified, newly allocated or grown regions retained whatever bytes were previously resident in the kmalloc slab.
When the caller-supplied payload is shorter than the aligned record size, the padding gap between the sample data and the timestamp is never written. Those bytes are flushed to userspace along with each sample, leaking kernel heap contents. The disclosure classification maps to [CWE-908] Use of Uninitialized Resource and [CWE-200] Exposure of Sensitive Information.
Root Cause
The root cause is a missing allocator flag. devm_krealloc() returns memory in whatever state the SLAB/SLUB allocator provides, which is typically uninitialized. The fix passes __GFP_ZERO so that any newly provisioned bytes in the bounce buffer are cleared before the alignment padding is left untouched by the copy.
Attack Vector
Exploitation requires local access to an IIO character device (/dev/iio:deviceN) with read permissions. An attacker reads samples from an affected buffered channel whose sample size is not a multiple of 8 bytes and whose timestamp is enabled. Each read returns kernel memory in the alignment slack bytes. Repeated reads can be used to harvest pointers, cryptographic material, or other secrets residing nearby in the slab.
No code example is included because no verified public proof-of-concept is available. See the upstream commits for implementation details: Kernel commit 3a87212 and Kernel commit b5c2f21.
Detection Methods for CVE-2026-98668
Indicators of Compromise
- No file-based indicators of compromise exist for this vulnerability because exploitation leaves no artifacts on disk.
- Anomalous or sustained read activity against /dev/iio:deviceN nodes by non-sensor processes may indicate harvesting of leaked bytes.
Detection Strategies
- Audit loaded IIO drivers and determine which register channels with non-8-byte-aligned sample sizes and timestamping enabled.
- Verify kernel package versions against distribution advisories referencing the five upstream fix commits.
- Instrument kernel builds with KMSAN during testing to catch uninitialized memory reads originating from IIO buffer paths.
Monitoring Recommendations
- Monitor auditd for open() and read() syscalls on /dev/iio:* by unexpected UIDs or long-running processes.
- Track process access patterns to /sys/bus/iio/devices/ entries to identify enumeration of buffered sensor channels.
- Alert on new or unprivileged users being granted membership in groups owning IIO device nodes.
How to Mitigate CVE-2026-98668
Immediate Actions Required
- Apply the kernel update from your distribution that incorporates the upstream fix setting __GFP_ZERO on the IIO bounce-buffer allocation.
- Restrict read permissions on /dev/iio:deviceN nodes to trusted users and services only.
- Unload IIO drivers that are not required on production systems to reduce the attack surface.
Patch Information
The fix is distributed across the stable trees in five commits: Kernel commit 3a87212, Kernel commit 5330036, Kernel commit b134ef8, Kernel commit b4f53ce, and Kernel commit b5c2f21. The patch adds __GFP_ZERO to the devm_krealloc() call so extra bounce-buffer bytes are zeroed before use.
Workarounds
- Tighten DAC/MAC permissions on IIO device nodes using udev rules or SELinux policy to prevent unprivileged read access.
- Disable timestamping on affected IIO channels where application requirements allow, which avoids the unaligned bounce-buffer code path.
- Blacklist unused IIO sensor modules via /etc/modprobe.d/ to prevent them from registering buffered channels.
# Example udev rule restricting IIO device access to a dedicated group
# /etc/udev/rules.d/90-iio-restrict.rules
KERNEL=="iio:device[0-9]*", GROUP="iio", MODE="0640"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
