Executive brief
The AD5686 digital-to-analog converter (DAC) driver in the Linux kernel lacks a NULL pointer check when device matching data is retrieved. An attacker with local access could bind the driver to an unregistered device via sysfs, causing a NULL pointer dereference that crashes the kernel and disrupts system availability.
Technical details
The vulnerability is a missing NULL pointer check in the AD5686 DAC driver (ad5686-spi.c and ad5696-i2c.c). When a user binds the driver via sysfs using driver_override with a device name not present in the id_table or of_match_table, the spi_get_device_match_data() or i2c_get_match_data() functions return NULL. The code then passes this NULL pointer directly to ad5686_probe(), which dereferences it, causing a kernel NULL pointer dereference. The fix adds explicit NULL checks before the probe call and returns -ENODATA if match data is missing. Attack requires local system access to write to sysfs driver_override controls.
Affected products
- Linux Linux kernel prior to commit 572a008526359cdac2fa935dad75e9d50a79792f
Timeline
- 2026-09-17: disclosed
- 2026-07-19: patched: Commit 572a008526359cdac2fa935dad75e9d50a79792f