CVE-2026-64502

Status: UPDATED  |  Advisory ID: CVE-2026-64502

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices

ad_sigma_delta_clear_pending_event() falls through to the status register

read path for devices with has_registers = false and no rdy_gpiod. For

such devices, ad_sd_read_reg() skips the address byte entirely and clocks

raw MISO bytes with no address phase — making it byte-for-byte identical

to reading conversion data. If a pending conversion result is present,

this partially consumes it and corrupts the data stream for the subsequent

ad_sd_read_reg() call in ad_sigma_delta_single_conversion().

Furthermore, with num_resetclks = 0 on these devices, data_read_len

evaluates to 0. If the clocked byte has bit 7 clear, pending_event is set

and the code attempts memset(data + 2, 0xff, 0 - 1), overflowing to

SIZE_MAX and corrupting the heap.

Fix by returning 0 immediately when neither rdy_gpiod nor has_registers

is set. This is safe for all current registerless devices: ad7191 and

ad7780 (with powerdown GPIO) are reset between conversions by CS

deassertion, so there is no stale result to drain; ad7780 (without

powerdown GPIO) and max11205 are continuously-converting and cycle ~DRDY

at the output data rate regardless of whether the previous result was

read, so the next falling edge fires naturally.

A future registerless device that holds ~DRDY asserted until data is read

would be broken by this early return and would require either

num_resetclks set or a rdy-gpio.

The same heap corruption is reachable on any device with rdy_gpiod set

but num_resetclks = 0: if the GPIO indicates a pending event, the drain

path executes memset(data + 2, 0xff, 0 - 1) regardless of has_registers.

Add an explicit data_read_len == 0 guard after the pending event check;

the stale result is then consumed by the first ad_sd_read_reg() call in

ad_sigma_delta_single_conversion(). (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References