Executive brief
A Linux kernel driver for AD525x digital potentiometers (electronic volume/resistance controllers used in audio and instrumentation devices) had improper management of sysfs interface files during device probe and removal. The fix migrates sysfs attribute creation to the driver core framework, ensuring proper cleanup and avoiding resource leaks when device probing fails or devices are removed.
Technical details
The vulnerability exists in the ad525x_dpot driver (drivers/misc/ad525x_dpot.c, ad525x_dpot-i2c.c, and ad525x_dpot-spi.c). The ad_dpot_probe() function manually created per-RDAC sysfs attribute files and optionally created command attribute groups, placing responsibility for rollback on partial probe failure and for cleanup during device removal onto driver code. This approach is error-prone and difficult to maintain. The fix moves device attributes into driver core dev_groups declarations for both I2C and SPI bus drivers and implements an is_visible() callback to selectively expose only attributes supported by each probed device variant. With this refactoring, the driver core automatically handles sysfs file creation only after probe completes successfully and removes files before the driver's remove callback executes, eliminating manual resource management complexity.
Affected products
- Linux Linux Kernel multiple versions (patch backported across 2.6.11 through 7.2 stable branches)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched