CVE-2026-98675: Linux Kernel IIO ADC Event Handling Flaw

CVE-2026-98675 Overview

CVE-2026-98675 is a logic flaw in the Linux kernel's Industrial I/O (IIO) analog-to-digital converter (ADC) driver for the Analog Devices ADE9000 energy metering IC. The ADE9000_ST1_CROSSING_DEPTH constant was defined as 25 and used as an exclusive upper bound when scanning the STATUS1 event register bits. As a result, bit 25 (ADE9000_ST1_DIPC_BIT), which signals Phase C voltage dip events, was never scanned inside the IRQ1 handler. Phase C dip events were silently dropped and never reported to userspace. The fix bumps the bound to 26 so bit 25 is included in the scan.

Critical Impact
Phase C voltage dip events raised by the ADE9000 energy meter were not reported through the IIO interface, causing monitoring and protection logic that depends on these events to miss power-quality incidents.

Affected Products

Linux kernel builds including the iio/adc/ade9000 driver prior to the fix
Systems using the Analog Devices ADE9000 ADC through the Linux IIO subsystem
Stable kernel branches referenced by commits d338af0, f73b94a, and fafefa9

Discovery Timeline

2026-10-18 - CVE-2026-98675 published to the National Vulnerability Database (NVD)
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98675

Vulnerability Analysis

The ADE9000 is an energy metering integrated circuit that exposes power-quality events through its STATUS1 register. The Linux IIO driver reads this register inside the IRQ1 interrupt service routine and iterates over the event bits to dispatch them to userspace consumers. The iteration uses ADE9000_ST1_CROSSING_DEPTH as an exclusive upper bound.

Because the macro was defined as 25, the loop walked bits 0 through 24 and stopped before bit 25. Bit 25 corresponds to ADE9000_ST1_DIPC_BIT, which signals a voltage dip on Phase C. The driver therefore acknowledged the interrupt without ever generating an IIO event for Phase C dips. Phase A and Phase B dips, mapped to lower-numbered bits, continued to be reported normally.

The defect is a classic off-by-one boundary condition. It does not corrupt memory, elevate privileges, or crash the kernel. The security consequence is a loss of event visibility for industrial monitoring, protective relaying, and power-quality logging applications that rely on Phase C dip notifications.

Root Cause

The root cause is an incorrect constant value controlling an iteration boundary [CWE-193 Off-by-one]. ADE9000_ST1_CROSSING_DEPTH was set to 25 while being used as an exclusive upper bound for a bit range that must include bit 25. The fix increases the constant to 26 so the final bit is scanned.

Attack Vector

This issue is not remotely exploitable and does not grant code execution. The impact is reliability and completeness of hardware event reporting. In environments where Phase C dip detection feeds safety interlocks, alarm systems, or SCADA telemetry, the missing events can mask real electrical faults and delay operator response.

See the upstream fix in Linux Kernel Commit d338af0, Linux Kernel Commit f73b94a, and Linux Kernel Commit fafefa9 for the one-line constant change.

Detection Methods for CVE-2026-98675

Indicators of Compromise

No malicious indicators apply. The defect manifests as the absence of expected IIO events for Phase C voltage dips in sysfs or event file descriptors exposed by the ade9000 driver.
Discrepancies between the ADE9000's internal STATUS1 register (bit 25 set) and the absence of a corresponding IIO event in userspace logs.

Detection Strategies

Audit running kernels for the presence of the ade9000 driver and compare the build against the patched commits d338af0, f73b94a, and fafefa9.
Inject or observe Phase C dip conditions on test hardware and verify that the IIO event interface emits the expected event.
Review dmesg and IIO event logs for a gap in Phase C dip events while Phase A and Phase B events are present.

Monitoring Recommendations

Correlate IIO event counts across phases to flag asymmetric event rates that may indicate missed Phase C events.
Track kernel package versions on industrial Linux hosts and alert on hosts still running pre-patch builds of the ade9000 driver.
Capture STATUS1 register snapshots during planned power-quality tests to confirm end-to-end event delivery after patching.

How to Mitigate CVE-2026-98675

Immediate Actions Required

Update affected Linux systems to a kernel version that includes commits d338af0, f73b94a, or fafefa9 for the iio/adc/ade9000 driver.
Inventory industrial and embedded Linux assets that use the Analog Devices ADE9000 ADC and prioritize them for kernel updates.
Re-validate Phase C dip detection in test environments after patching to confirm restored event reporting.

Patch Information

The upstream fix changes ADE9000_ST1_CROSSING_DEPTH from 25 to 26 so that the IRQ1 handler scans bit 25 (ADE9000_ST1_DIPC_BIT). Patches are available in Linux Kernel Commit d338af0, Linux Kernel Commit f73b94a, and Linux Kernel Commit fafefa9. Apply the fix via your distribution's stable kernel update channel.

Workarounds

No supported workaround exists in the kernel driver. Operators needing Phase C dip visibility before patching can poll the ADE9000 STATUS1 register from userspace over the device bus and parse bit 25 directly.
Where feasible, supplement ADE9000 telemetry with an independent power-quality monitor until the patched kernel is deployed.

bash

# Verify the running kernel includes the ade9000 fix
modinfo ade9000 | grep -E 'filename|version|srcversion'
uname -r
# Check that your distro kernel changelog references one of the fix commits:
#   d338af069f08658f53231adb445ddb10048730ac
#   f73b94acc7ec81f9c49feb87f649ba5a80a0905c
#   fafefa925ed7ec10383d9bf0378abf878b7f13cb