CVE-2026-64502 (GCVE-0-2026-64502)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-08-17 04:56
VLAI
Title
iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices
Summary
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices ad_sigma_delta_clear_pending_event() falls through to the status register read path for devices with has_registers = false and no rdy_gpiod. For such devices, ad_sd_read_reg() skips the address byte entirely and clocks raw MISO bytes with no address phase — making it byte-for-byte identical to reading conversion data. If a pending conversion result is present, this partially consumes it and corrupts the data stream for the subsequent ad_sd_read_reg() call in ad_sigma_delta_single_conversion(). Furthermore, with num_resetclks = 0 on these devices, data_read_len evaluates to 0. If the clocked byte has bit 7 clear, pending_event is set and the code attempts memset(data + 2, 0xff, 0 - 1), overflowing to SIZE_MAX and corrupting the heap. Fix by returning 0 immediately when neither rdy_gpiod nor has_registers is set. This is safe for all current registerless devices: ad7191 and ad7780 (with powerdown GPIO) are reset between conversions by CS deassertion, so there is no stale result to drain; ad7780 (without powerdown GPIO) and max11205 are continuously-converting and cycle ~DRDY at the output data rate regardless of whether the previous result was read, so the next falling edge fires naturally. A future registerless device that holds ~DRDY asserted until data is read would be broken by this early return and would require either num_resetclks set or a rdy-gpio. The same heap corruption is reachable on any device with rdy_gpiod set but num_resetclks = 0: if the GPIO indicates a pending event, the drain path executes memset(data + 2, 0xff, 0 - 1) regardless of has_registers. Add an explicit data_read_len == 0 guard after the pending event check; the stale result is then consumed by the first ad_sd_read_reg() call in ad_sigma_delta_single_conversion().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 132d44dc6966c1cf841ffe0f6f048165687e870b , < 3394e0b3328422431cadaf314fa58d3717ed4936 (git)
Affected: 132d44dc6966c1cf841ffe0f6f048165687e870b , < 3bceb26dfaf7ba805b459e41c1d0ba916862dade (git)
Affected: 132d44dc6966c1cf841ffe0f6f048165687e870b , < 91bc6767a4f55dc470d8a56b55b9f2ea09094efe (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/ad_sigma_delta.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3394e0b3328422431cadaf314fa58d3717ed4936",
              "status": "affected",
              "version": "132d44dc6966c1cf841ffe0f6f048165687e870b",
              "versionType": "git"
            },
            {
              "lessThan": "3bceb26dfaf7ba805b459e41c1d0ba916862dade",
              "status": "affected",
              "version": "132d44dc6966c1cf841ffe0f6f048165687e870b",
              "versionType": "git"
            },
            {
              "lessThan": "91bc6767a4f55dc470d8a56b55b9f2ea09094efe",
              "status": "affected",
              "version": "132d44dc6966c1cf841ffe0f6f048165687e870b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/ad_sigma_delta.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices\n\nad_sigma_delta_clear_pending_event() falls through to the status register\nread path for devices with has_registers = false and no rdy_gpiod. For\nsuch devices, ad_sd_read_reg() skips the address byte entirely and clocks\nraw MISO bytes with no address phase \u2014 making it byte-for-byte identical\nto reading conversion data. If a pending conversion result is present,\nthis partially consumes it and corrupts the data stream for the subsequent\nad_sd_read_reg() call in ad_sigma_delta_single_conversion().\n\nFurthermore, with num_resetclks = 0 on these devices, data_read_len\nevaluates to 0. If the clocked byte has bit 7 clear, pending_event is set\nand the code attempts memset(data + 2, 0xff, 0 - 1), overflowing to\nSIZE_MAX and corrupting the heap.\n\nFix by returning 0 immediately when neither rdy_gpiod nor has_registers\nis set. This is safe for all current registerless devices: ad7191 and\nad7780 (with powerdown GPIO) are reset between conversions by CS\ndeassertion, so there is no stale result to drain; ad7780 (without\npowerdown GPIO) and max11205 are continuously-converting and cycle ~DRDY\nat the output data rate regardless of whether the previous result was\nread, so the next falling edge fires naturally.\n\nA future registerless device that holds ~DRDY asserted until data is read\nwould be broken by this early return and would require either\nnum_resetclks set or a rdy-gpio.\n\nThe same heap corruption is reachable on any device with rdy_gpiod set\nbut num_resetclks = 0: if the GPIO indicates a pending event, the drain\npath executes memset(data + 2, 0xff, 0 - 1) regardless of has_registers.\nAdd an explicit data_read_len == 0 guard after the pending event check;\nthe stale result is then consumed by the first ad_sd_read_reg() call in\nad_sigma_delta_single_conversion()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An attacker reaches the flaw locally by reading a world-readable IIO raw sysfs attribute, which invokes the vulnerable conversion path through read(2). No network or physical-device insertion path is required.\nAC:L - Continuously converting MAX11205 and AD7780 deployments naturally produce the pending result needed to trigger the size underflow. Repeated reads or attacker-controlled interruption of a conversion make the condition reproducible without an uncontrollable race.\nPR:L - IIO raw attributes are created with mode 0444, and the read path performs no capability, authentication, or namespace privilege check. A basic unprivileged local user is sufficient.\nUI:N - The attacker directly reads the sensor attribute and does not require another user to perform any action.\nS:U - The vulnerable driver and the affected kernel resources belong to the same operating-system security authority. Kernel privilege escalation does not itself constitute a scope change.\nC:H - The one-byte allocation is followed by an effectively unbounded heap overwrite, allowing adjacent kernel objects to be corrupted. Heap grooming and concurrent use of corrupted objects could yield control-flow or memory-disclosure primitives exposing arbitrary kernel and process data.\nI:H - The massive out-of-bounds write can corrupt arbitrary adjacent kernel objects and potentially enable control-flow hijacking or privilege escalation.\nA:H - A trigger can cause a fortification panic, kernel page fault or oops, or catastrophic heap corruption, and an unprivileged attacker can repeat it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:56:52.172Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3394e0b3328422431cadaf314fa58d3717ed4936"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bceb26dfaf7ba805b459e41c1d0ba916862dade"
        },
        {
          "url": "https://git.kernel.org/stable/c/91bc6767a4f55dc470d8a56b55b9f2ea09094efe"
        }
      ],
      "title": "iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64502",
    "datePublished": "2026-07-25T08:51:57.477Z",
    "dateReserved": "2026-07-19T15:36:31.793Z",
    "dateUpdated": "2026-08-17T04:56:52.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64502",
      "date": "2026-09-24",
      "epss": "0.00173",
      "percentile": "0.05905"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iio/adc/ad_sigma_delta.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3394e0b3328422431cadaf314fa58d3717ed4936",
                    "status": "affected",
                    "version": "132d44dc6966c1cf841ffe0f6f048165687e870b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3bceb26dfaf7ba805b459e41c1d0ba916862dade",
                    "status": "affected",
                    "version": "132d44dc6966c1cf841ffe0f6f048165687e870b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "91bc6767a4f55dc470d8a56b55b9f2ea09094efe",
                    "status": "affected",
                    "version": "132d44dc6966c1cf841ffe0f6f048165687e870b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iio/adc/ad_sigma_delta.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices\n\nad_sigma_delta_clear_pending_event() falls through to the status register\nread path for devices with has_registers = false and no rdy_gpiod. For\nsuch devices, ad_sd_read_reg() skips the address byte entirely and clocks\nraw MISO bytes with no address phase \u2014 making it byte-for-byte identical\nto reading conversion data. If a pending conversion result is present,\nthis partially consumes it and corrupts the data stream for the subsequent\nad_sd_read_reg() call in ad_sigma_delta_single_conversion().\n\nFurthermore, with num_resetclks = 0 on these devices, data_read_len\nevaluates to 0. If the clocked byte has bit 7 clear, pending_event is set\nand the code attempts memset(data + 2, 0xff, 0 - 1), overflowing to\nSIZE_MAX and corrupting the heap.\n\nFix by returning 0 immediately when neither rdy_gpiod nor has_registers\nis set. This is safe for all current registerless devices: ad7191 and\nad7780 (with powerdown GPIO) are reset between conversions by CS\ndeassertion, so there is no stale result to drain; ad7780 (without\npowerdown GPIO) and max11205 are continuously-converting and cycle ~DRDY\nat the output data rate regardless of whether the previous result was\nread, so the next falling edge fires naturally.\n\nA future registerless device that holds ~DRDY asserted until data is read\nwould be broken by this early return and would require either\nnum_resetclks set or a rdy-gpio.\n\nThe same heap corruption is reachable on any device with rdy_gpiod set\nbut num_resetclks = 0: if the GPIO indicates a pending event, the drain\npath executes memset(data + 2, 0xff, 0 - 1) regardless of has_registers.\nAdd an explicit data_read_len == 0 guard after the pending event check;\nthe stale result is then consumed by the first ad_sd_read_reg() call in\nad_sigma_delta_single_conversion()."
          }
        ],
        "id": "CVE-2026-64502",
        "lastModified": "2026-08-17T05:17:56.263",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:36.200",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3394e0b3328422431cadaf314fa58d3717ed4936"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3bceb26dfaf7ba805b459e41c1d0ba916862dade"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/91bc6767a4f55dc470d8a56b55b9f2ea09094efe"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-29T08:15:01+00:00",
      "cve": "CVE-2026-64502",
      "id": "CVE-2026-64502",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64502.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.