Junglewise Threat Intelligence

CVE-2026-31768: Linux Kernel ti-adc161s626 DMA-safe memory corruption

CVE-2026-31768 · Severity: high · CVSS 7.8 · Published 2026-05-01

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability was identified in the Linux kernel's driver for certain Texas Instruments analog-to-digital converters (ADC). The issue stems from the use of unsafe memory locations for data transfers, which could allow a local attacker to compromise the integrity or confidentiality of the system. This affects various industrial control systems, such as Siemens SIMATIC S7-1500 CPUs, that utilize these kernel drivers.

Technical details

The vulnerability exists in the ti-adc161s626 ADC driver within the Industrial I/O (IIO) subsystem of the Linux kernel. The driver incorrectly used stack-allocated memory for SPI receive buffers via spi_read(). In the Linux kernel, all buffers used for SPI DMA transfers must be DMA-safe (typically heap-allocated and cache-aligned) to prevent memory corruption or data leakage caused by cache incoherency or architectural constraints on DMA access to stack memory. A local attacker with low privileges could potentially exploit this to cause a system crash or achieve escalated privileges. The fix involves migrating the buffer to a DMA-safe member within the driver's private data structure.

Affected products

  • Linux Linux Kernel 4d671b71beef to b3bb8faeca1a2ef7be95ee8a512b639f9ffce947
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-14: other: Patch authored
  • 2026-05-01: disclosed: CVE published
  • 2026-07-14: advisory: Siemens advisory updated with affected products

References

Related threats