CVE-2026-98677: Linux Kernel IIO ADC Use-After-Free Vulnerability

CVE-2026-98677 Overview

CVE-2026-98677 is a use-after-free vulnerability in the Linux kernel's Industrial I/O (IIO) subsystem, specifically in the ad_sigma_delta ADC driver. The flaw occurs during driver unbind, where devres resources release in reverse allocation order. Because ad_sd_buffer_postenable() allocates sigma_delta->samples_buf at runtime using devm_krealloc(), the buffer is freed before iio_device_unregister() disables the data-ready IRQ. The trigger handler ad_sd_trigger_handler() can then memcpy() incoming samples into freed memory. The issue was identified by an in-house static analysis tool and resolved by preallocating the buffer during probe.

Critical Impact
A use-after-free during driver unbind can corrupt kernel memory when the sigma-delta ADC IRQ fires after samples_buf has been freed, potentially leading to kernel memory corruption or local privilege escalation on affected systems.

Affected Products

Linux kernel versions containing the iio/adc/ad_sigma_delta driver prior to the fix commits
Systems using Analog Devices sigma-delta ADC hardware via the IIO subsystem
Distributions shipping affected stable kernel branches referenced in the upstream fix commits

Discovery Timeline

2026-10-18 - CVE-2026-98677 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98677

Vulnerability Analysis

The vulnerability resides in the ad_sigma_delta driver within the Linux IIO ADC subsystem. The driver uses the device-managed resource (devres) framework to allocate the samples_buf buffer that stores incoming ADC samples. The allocation happens inside ad_sd_buffer_postenable() using devm_krealloc(), which is called at runtime rather than at probe time.

Devres entries are released in reverse order of allocation during driver unbind. Because samples_buf is allocated after all probe-time devres entries, it gets freed before iio_device_unregister() runs. However, the data-ready interrupt remains enabled when samples_buf is released. If the ADC asserts its data-ready line during this window, the kernel invokes ad_sd_trigger_handler(), which writes sample data into the already-freed buffer via memcpy().

The upstream fix preallocates the buffer inside devm_ad_sd_setup_buffer_and_trigger() before the triggered buffer and IRQ are registered. The buffer is sized for the worst case of all sequencer slots being active, consistent with the cap enforced by ad_sd_validate_scan_mask().

Root Cause

The root cause is incorrect devres allocation ordering combined with runtime allocation of a buffer that is actively accessed by an interrupt handler. Freeing samples_buf before tearing down the IRQ and trigger pollfunc creates a window where the handler can write into freed memory, meeting the classic conditions for a use-after-free [CWE-416].

Attack Vector

Exploitation requires the attacker to be able to trigger driver unbind on a system with an active Analog Devices sigma-delta ADC generating samples. This generally requires local privileged access to write to sysfs unbind entries. The race window depends on hardware-generated IRQs, so reliable exploitation is constrained. No public exploit is available, and the EPSS score is low. The flaw is a reliability and memory-safety issue that, under adversarial conditions, could be chained toward kernel memory corruption.

See the upstream fix commits for full technical context: Kernel commit 5663c72, Kernel commit 84500ae0, Kernel commit 975b09bc, Kernel commit 9ee83061, and Kernel commit f20b94a7.

Detection Methods for CVE-2026-98677

Indicators of Compromise

Kernel oops or panic messages referencing ad_sd_trigger_handler, ad_sigma_delta, or iio_push_to_buffers around driver unbind events
KASAN use-after-free reports naming samples_buf on kernels built with memory sanitizers enabled
Unexpected unbind events on /sys/bus/iio/drivers/ad_sigma_delta or related sysfs paths

Detection Strategies

Audit installed kernel package versions against the fixed stable commits referenced in the upstream advisory
Enable KASAN in test or staging kernels to surface use-after-free conditions in the IIO subsystem
Monitor dmesg and journald logs for IIO buffer, trigger, or ADC driver errors coincident with device unbind

Monitoring Recommendations

Alert on write access to /sys/bus/*/drivers/*/unbind entries from unprivileged or unexpected processes
Track kernel crash telemetry for stack traces that include devm_krealloc cleanup paths or IIO trigger handlers
Correlate hardware IRQ activity on sigma-delta ADC devices with driver lifecycle events in endpoint telemetry

How to Mitigate CVE-2026-98677

Immediate Actions Required

Apply the upstream Linux kernel patches that preallocate samples_buf in devm_ad_sd_setup_buffer_and_trigger()
Update to a stable kernel release that includes the fix commits listed in the external references
Restrict access to driver unbind sysfs entries to root-only workflows and audited administrative tooling

Patch Information

The fix is distributed across multiple stable branches. Reference commits include 5663c72b, 84500ae0, 975b09bc, 9ee83061, and f20b94a7. Verify that your distribution kernel incorporates the corresponding backport before closing remediation tickets. Consult your Linux distribution's security tracker for the exact package version containing the fix.

Workarounds

Avoid unbinding the ad_sigma_delta driver on production systems while sampling is active
Disable or physically disconnect affected Analog Devices sigma-delta ADC hardware where it is not required
Limit local shell and administrative access to systems exposing IIO ADC devices until patched kernels are deployed

bash

# Verify running kernel version and check for the fix
uname -r

# On Debian/Ubuntu, review installed kernel changelog for the CVE
apt changelog linux-image-$(uname -r) | grep -i CVE-2026-98677

# On RHEL/Fedora systems
rpm -q --changelog kernel | grep -i CVE-2026-98677