CVE-2026-31768: Linux Kernel ti-adc161s626 DMA-safe memory corruption

CVE-2026-31768 · Severity: high · CVSS 7.8 · Published 2026-05-01

A vulnerability was identified in the Linux kernel's driver for certain Texas Instruments analog-to-digital converters (ADC). The issue stems from the use of unsafe memory locations for data transfers, which could allow a local attacker to compromise the integrity or confidentiality of the system. This affects various industrial control systems, such as Siemens SIMATIC S7-1500 CPUs, that utilize these kernel drivers.

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Quick answers

Is CVE-2026-31768 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-31768 being exploited in the wild.
How severe is CVE-2026-31768?
High severity, with a CVSS score of 7.8, published 1 May 2026.
Which products and versions are affected?
Linux Kernel versions from 4.9 up to 6.1.168; 6.2 up to 6.6.134; 6.7 up to 6.12.81; 6.13 up to 6.18.22; 6.19 up to 6.19.12; 7.0-rc1 to 7.0-rc6; Linux Kernel 4d671b71beef to b3bb8faeca1a2ef7be95ee8a512b639f9ffce947; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6; and 1 more.
Is there a fix for CVE-2026-31768?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-31768 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-31768?
Check whether you run Linux Kernel, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the ti-adc161s626 ADC driver within the Industrial I/O (IIO) subsystem of the Linux kernel. The driver incorrectly used stack-allocated memory for SPI receive buffers via spi_read(). In the Linux kernel, all buffers used for SPI DMA transfers must be DMA-safe (typically heap-allocated and cache-aligned) to prevent memory corruption or data leakage caused by cache incoherency or architectural constraints on DMA access to stack memory. A local attacker with low privileges could potentially exploit this to cause a system crash or achieve escalated privileges. The fix involves migrating the buffer to a DMA-safe member within the driver's private data structure.

Affected products

  • Linux Linux Kernel 4d671b71beef to b3bb8faeca1a2ef7be95ee8a512b639f9ffce947
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-14: other: Patch authored
  • 2026-05-01: disclosed: CVE published
  • 2026-07-14: advisory: Siemens advisory updated with affected products

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.