CVE-2026-98671: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-98671 Overview

CVE-2026-98671 affects the Linux kernel's sun4i-gpadc-iio Industrial I/O (IIO) analog-to-digital converter (ADC) driver. The driver fails to perform proper cleanup when devm_thermal_of_zone_register() returns an error during probe. Specifically, the probe path returns without unregistering the IIO map array or disabling runtime power management (PM). The upstream fix redirects the error path to the err_map label, ensuring resources are released on failure. The flaw is a resource management defect in a kernel driver primarily used on Allwinner sun4i-family system-on-chip (SoC) platforms.

Critical Impact
Failed thermal zone registration leaves IIO maps registered and runtime PM enabled, producing resource leaks and potential driver state inconsistencies on affected Allwinner-based Linux systems.

Affected Products

Linux kernel iio/adc/sun4i-gpadc-iio driver (pre-patch versions)
Allwinner sun4i-family SoC platforms using the general-purpose ADC (GPADC) driver
Downstream Linux distributions shipping unpatched stable kernels

Discovery Timeline

2026-10-18 - CVE-2026-98671 published to the National Vulnerability Database (NVD)
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98671

Vulnerability Analysis

The defect resides in the probe function of the sun4i-gpadc-iio driver, part of the Linux kernel IIO ADC subsystem. During device initialization, the driver registers an IIO map array and enables runtime PM before calling devm_thermal_of_zone_register() to register the SoC thermal zone. When that registration fails, the original code returned immediately from probe without reversing the earlier initialization steps. The resident IIO map array remained registered and runtime PM remained enabled on a device whose probe had failed. The fix changes the failure path to jump to the existing err_map label, which handles IIO map unregistration and runtime PM teardown. This brings the error handling in line with the resource acquisition order established earlier in probe.

Root Cause

The root cause is a missing error-path cleanup, categorized as improper resource release during probe failure. The developer added a new call to devm_thermal_of_zone_register() without routing its failure return through the driver's existing unwind sequence. The result is a classic probe-time resource leak.

Attack Vector

Triggering the condition requires the thermal zone registration to fail on an Allwinner platform running the affected driver. This is a local, kernel-space defect reachable only through driver initialization on supported hardware. No remote or user-triggered attack vector has been documented. The Exploit Prediction Scoring System (EPSS) data indicates a low likelihood of exploitation activity. No public proof-of-concept, exploit, or CISA Known Exploited Vulnerabilities (KEV) listing is associated with this CVE.

No verified exploit code is available. See the upstream commits referenced in the Patch Information section for the exact source-level change.

Detection Methods for CVE-2026-98671

Indicators of Compromise

Kernel log messages reporting devm_thermal_of_zone_register failure followed by probe failure for sun4i-gpadc-iio without a corresponding unregister entry.
Persistent references to the GPADC IIO map after probe failure, visible under /sys/bus/iio/devices/.
Runtime PM remaining enabled for the GPADC device after a failed probe, observable via /sys/devices/.../power/runtime_status.

Detection Strategies

Inventory running kernel versions on Allwinner sun4i-based devices and compare against the fixed stable kernel commits listed under Patch Information.
Parse dmesg output for repeated probe failures of the sun4i-gpadc-iio driver that are not followed by clean teardown messages.
Use configuration management tooling to flag embedded Linux images that still ship pre-patch kernels for this driver.

Monitoring Recommendations

Monitor kernel log ingestion pipelines for probe-failure patterns tied to IIO ADC and thermal subsystem initialization.
Track kernel package versions across fleet inventory and alert when devices run kernels missing the referenced stable backports.
Review build pipelines for custom kernels to confirm the fix is included in downstream branches.

How to Mitigate CVE-2026-98671

Immediate Actions Required

Update affected Linux kernels to a version that includes the upstream fix for the sun4i-gpadc-iio cleanup path.
For custom or vendor kernels, backport one of the listed stable commits into the affected branch and rebuild.
Validate that sun4i-gpadc-iio probes cleanly after the update on representative Allwinner hardware.

Patch Information

The fix is available in the following upstream Linux kernel stable commits: Kernel Git Commit 1bad19e, Kernel Git Commit 2cdc7ef, Kernel Git Commit 53473b0, Kernel Git Commit d74c248, and Kernel Git Commit feae7e0. Each commit redirects the failure path of devm_thermal_of_zone_register() to the err_map label so that the IIO map array is unregistered and runtime PM is disabled.

Workarounds

Disable the sun4i-gpadc-iio driver in the kernel configuration on devices that do not require GPADC or thermal zone functionality.
Avoid loading the driver on hardware where thermal zone registration is known to fail until the patched kernel is deployed.
Rebuild affected embedded images with the fix applied before redeployment to field devices.

bash

# Verify kernel version includes the fix on a running system
uname -r
dmesg | grep -i 'sun4i-gpadc-iio'