Executive brief
A vulnerability in the Linux kernel's Analog Devices Sigma-Delta ADC driver could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when the system attempts to clear pending events on certain hardware configurations, leading to memory corruption. This affects industrial and scientific equipment using specific Analog-to-Digital converters managed by this driver.
Technical details
A heap overflow exists in the ad_sigma_delta_clear_pending_event() function within the Linux kernel's IIO ADC subsystem (drivers/iio/adc/ad_sigma_delta.c). For devices where has_registers is false and no rdy_gpiod is present, or when num_resetclks is 0, the driver incorrectly falls through to a status register read path. This results in an integer underflow when calculating the length for a memset operation (memset(data + 2, 0xff, 0 - 1)), causing a buffer overflow of SIZE_MAX bytes. An attacker with local access could exploit this to corrupt kernel heap memory, leading to a Denial of Service (DoS) or potential privilege escalation. The issue has been patched by adding explicit guards for registerless devices and zero-length data reads.
Affected products
- Linux Linux Kernel 132d44dc6966 to 3394e0b33284, 3bceb26dfaf7, 91bc6767a4f5
Timeline
- 2026-05-27: other: Patch authored
- 2026-07-18: patched: Patch committed to stable tree
- 2026-07-25: disclosed: CVE published