Executive brief
A vulnerability was identified in the Linux kernel's handling of certain Analog Devices Sigma-Delta converters, which are components used to translate analog signals into digital data. Due to a logic error in the driver, the system could leave the hardware in an incorrect state or fail to properly lock the communication bus after an error occurs. This could lead to hardware malfunctions or allow different parts of the system to interfere with each other's data, potentially impacting the reliability of industrial or scientific equipment using these sensors.
Technical details
A vulnerability in the Linux kernel's Industrial I/O (IIO) subsystem, specifically within the ad_sigma_delta ADC driver, stems from improper state cleanup in ad_sigma_delta_single_conversion() and ad_sd_buffer_postenable(). In the single conversion path, set_mode() and disable_one() were called while keep_cs_asserted remained true, causing SPI transfers to carry a cs_change=1 flag and leaving the Chip Select line permanently asserted. In the buffer post-enable error path, failing to clear keep_cs_asserted and bus_locked before releasing the SPI bus allows subsequent operations to attempt spi_sync_locked() without an actual lock, leading to race conditions and concurrent SPI access. The issue has been resolved by reordering cleanup operations to ensure flags are cleared before mode changes and bus unlocking.
Affected products
- Linux Linux Kernel 6.14, 6.18.39, 7.1.4, 7.2-rc1
Timeline
- 2026-05-27: disclosed: Initial patch submitted by Radu Sabau
- 2026-07-25: advisory: CVE-2026-64501 published