CVE-2026-98672: Linux Kernel IIO ADC Division by Zero

CVE-2026-98672 Overview

CVE-2026-98672 is a division-by-zero vulnerability in the Linux kernel's Industrial I/O (IIO) subsystem, specifically in the STM32 Analog-to-Digital Converter (ADC) driver (stm32-adc). The flaw occurs when the ADC driver processes a channel value without first checking whether the conversion succeeded or returned zero. When the converted value is zero, such as from the Vrefint reference channel, subsequent arithmetic operations on *val can trigger a division by zero in kernel space. The issue has been resolved through upstream kernel commits.

Critical Impact
A division by zero in kernel context on affected STM32 hardware can cause a kernel exception, leading to denial of service on the device.

Affected Products

Linux kernel IIO subsystem
STM32 ADC driver (drivers/iio/adc/stm32-adc)
Embedded Linux distributions running on STM32 platforms

Discovery Timeline

2026-10-18 - CVE-2026-98672 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98672

Vulnerability Analysis

The vulnerability resides in the processed-channel read path of the STM32 ADC driver. When a consumer reads a processed value from the IIO framework, the driver performs a raw conversion and then applies scaling arithmetic to produce a calibrated result. The arithmetic path divides by the converted value in some scaling operations. The driver did not validate the conversion status or the result before using it as a divisor.

If the hardware conversion fails or returns zero, as can happen with the internal reference voltage channel (Vrefint), the division operation produces a kernel-level divide-by-zero fault. On most architectures this generates a trap handled by the kernel, which may oops the process or destabilize the driver state.

Root Cause

The root cause is missing input validation on the output of the ADC conversion function. The driver assumed the raw value was both valid and non-zero before using it in a denominator. A zero reading from Vrefint should be treated as an invalid measurement in all cases, but the original code did not enforce this invariant.

Attack Vector

Triggering the condition requires access to the IIO sysfs or character device interface for the affected ADC channel on an STM32 device. The vector is local and depends on the ability of a user-space process, or an upstream signal condition, to cause a failed or zero-valued conversion. There is no evidence of remote exploitation or privilege escalation; the primary impact is kernel-side error handling and potential denial of service on the embedded platform.

For the exact code changes, review the upstream fixes in Kernel Git Commit 30d27899, Kernel Git Commit 55f1cebe, Kernel Git Commit 6dd3bf78, Kernel Git Commit ab4e57ad, and Kernel Git Commit c5de6a6f.

Detection Methods for CVE-2026-98672

Indicators of Compromise

Kernel log entries referencing divide error or division by zero with a call stack pointing into stm32-adc or IIO channel-read functions.
Repeated reads of in_voltage_vrefint_* sysfs entries followed by driver errors or kernel oops messages.
Unexpected restarts of IIO consumers or user-space daemons that query ADC channels on STM32 devices.

Detection Strategies

Monitor dmesg and /var/log/kern.log for oops traces that include the STM32 ADC driver symbol names.
Audit the running kernel version on STM32-based fleets and compare it against the fixed stable kernel releases listed in the upstream commits.
Track usage patterns of the IIO sysfs interface to identify processes performing frequent or anomalous ADC reads.

Monitoring Recommendations

Forward kernel logs from embedded STM32 Linux systems to a centralized log collector for correlation and alerting on fault traces.
Alert on any kernel panic, oops, or BUG event originating from drivers/iio/adc/stm32-adc.c.
Baseline normal ADC read behavior to detect user-space processes that could intentionally induce invalid conversions.

How to Mitigate CVE-2026-98672

Immediate Actions Required

Identify all Linux systems running on STM32 hardware with the stm32-adc driver enabled in the kernel configuration.
Apply the upstream Linux kernel stable update that contains the fix for the STM32 ADC processed-channel path.
Restrict access to IIO sysfs and character device nodes to trusted user accounts and services only.

Patch Information

The fix is available in the mainline and stable Linux kernel trees via the following commits: Kernel Git Commit 30d27899, Kernel Git Commit 55f1cebe, Kernel Git Commit 6dd3bf78, Kernel Git Commit ab4e57ad, and Kernel Git Commit c5de6a6f. The patched driver validates the conversion status and treats a zero value as invalid before performing any scaling arithmetic.

Workarounds

Tighten Unix permissions on /sys/bus/iio/devices/iio:deviceX/ entries so that only privileged processes can read ADC channels.
Disable the stm32-adc driver via kernel configuration or module unloading on systems where the ADC is not required.
Isolate untrusted workloads from the IIO interface using Linux namespaces, seccomp filters, or mandatory access control policies.

bash

# Restrict IIO sysfs access to the root user and iio group
chown -R root:iio /sys/bus/iio/devices/iio:device0/
chmod -R o-rwx /sys/bus/iio/devices/iio:device0/

# Verify running kernel version against the fixed release
uname -r