Linux Kernel Vulnerability in SPEAR ADC Interrupt Handling

CVE-2026-64602

What is CVE-2026-64602?

The vulnerability in the Linux kernel affects the SPEAR ADC driver, where an interrupt handler is registered before initializing a completion structure. If an interrupt occurs just after the handler registration and before the completion is initialized, it can lead to a kernel panic due to dereferencing an uninitialized pointer. This situation arises when the 'spear_adc_probe()' function calls 'devm_request_irq()' prematurely, allowing the handler to execute 'complete()' on uninitialized data. To mitigate this risk, the initialization of the completion structure should be moved above the request for the interrupt, ensuring that the handler operates on a valid, initialized structure.

References