Heap Corruption Vulnerability in Linux Kernel Affecting Registerless Devices

CVE-2026-64502

What is CVE-2026-64502?

A vulnerability in the Linux kernel's IIO ADC subsystem can lead to heap corruption in registerless devices. The flaw originates in the ad_sigma_delta_clear_pending_event function, which improperly handles pending events when the device lacks registers and does not have a ready GPIO. This oversight can result in the unexpected consumption of conversion results, corrupting the data stream for subsequent read operations. The issues are exacerbated when num_resetclks is set to zero, leading to a dangerous overflow during the memory clearing operation. A fix has been implemented to prevent this situation by immediately returning when neither rdy_gpiod nor has_registers are activated, ensuring safe operation across current registerless devices such as ad7191 and ad7780. Admins are encouraged to apply patches promptly to reduce the risk of compromise.

References