CVE-2026-98668 iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iiopushtobufferswithtsunaligned leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled...

CVE-2026-98667

The Linux kernel contains a vulnerability in the iio: frequency: adf4377 driver where the clk_init_data and clk_parent_data structures are not fully initialized. Specifically, the adf4377_clk_register() function fails to initialize init.parent_names and several members of the clk_parent_data stru...

CVE-2026-98667 iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data

In the Linux kernel, the following vulnerability has been resolved: iio: frequency: adf4377: Fully initialize clkinitdata and clkparentdata The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to...

EUVD-2026-103921

In the Linux kernel, the following vulnerability has been resolved: iio: frequency: adf4377: Fully initialize clkinitdata and clkparentdata The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to...

CVE-2026-98666

The Linux kernel contains a vulnerability in the iio: gyro: adis16136 driver. The serial_number file operations are open coded and fail to call debugfs_file_get(), which is required by debugfs_create_file_unsafe(). This issue allows debugfs_remove_recursive() to proceed without waiting for active...

CVE-2026-98666 iio: gyro: adis16136: fix unprotected debugfs reads

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16136: fix unprotected debugfs reads The serialnumber file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does not wait for a read ...

EUVD-2026-103920

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16136: fix unprotected debugfs reads The serialnumber file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does not wait for a read ...

CVE-2026-98665

The Linux kernel contains a NULL pointer dereference vulnerability within the iio: health: max30102 driver. The issue exists in the max30102_interrupt_handler because the indio_dev->active_scan_mask is only valid when a buffer is enabled, but the interrupt remains active for the device's lifet...

CVE-2026-98665 iio: health: max30102: fix NULL dereference in interrupt handler

In the Linux kernel, the following vulnerability has been resolved: iio: health: max30102: fix NULL dereference in interrupt handler The interrupt is requested in max30102probe and stays enabled for the lifetime of the device, but indiodev-activescanmask is only valid while a buffer is enabled...

EUVD-2026-103919

In the Linux kernel, the following vulnerability has been resolved: iio: health: max30102: fix NULL dereference in interrupt handler The interrupt is requested in max30102probe and stays enabled for the lifetime of the device, but indiodev-activescanmask is only valid while a buffer is enabled...

EUVD-2026-103918

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprotected debugfs reads adis16400serialnumberfops is open coded and never calls debugfsfileget, so debugfsremoverecursive does not wait for a read in progress and unbind frees the iiodev underneath it...

CVE-2026-98664 iio: imu: adis16400: fix unprotected debugfs reads

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprotected debugfs reads adis16400serialnumberfops is open coded and never calls debugfsfileget, so debugfsremoverecursive does not wait for a read in progress and unbind frees the iiodev underneath it...

CVE-2026-98664

The Linux kernel contains a vulnerability in the iio: imu: adis16400 driver related to unprotected debugfs reads. Specifically, the adis16400_serial_number_fops is open-coded and fails to call debugfs_file_get(). This allows debugfs_remove_recursive() to proceed without waiting for active reads, ...

CVE-2026-98663 iio: imu: adis16480: fix unprotected debugfs reads

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16480: fix unprotected debugfs reads The firmwarerevision and firmwaredate file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does...

CVE-2026-98663

The Linux kernel contains a vulnerability in the iio: imu: adis16480 driver where the firmware_revision and firmware_date file operations are open coded and fail to call debugfs_file_get(). This missing call prevents debugfs_remove_recursive() from waiting for active reads, causing unbind to free...

EUVD-2026-103917

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16480: fix unprotected debugfs reads The firmwarerevision and firmwaredate file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does...

CVE-2026-98662

The Linux kernel contains a use-after-free vulnerability in the iio: light: gp2ap020a00f driver. The issue occurs because free_irq() does not flush irq_work that has already been queued by the threaded IRQ handler. Consequently, after gp2ap020a00f_remove() returns, the queued work may still execu...

CVE-2026-98662 iio: light: gp2ap020a00f: drain irq_work after free_irq

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap020a00f: drain irqwork after freeirq The threaded IRQ handler queues data-work through irqworkqueue so the trigger is polled from a per-CPU context. freeirq does not flush an irqwork the handler already queued, s...

EUVD-2026-103916

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap020a00f: drain irqwork after freeirq The threaded IRQ handler queues data-work through irqworkqueue so the trigger is polled from a per-CPU context. freeirq does not flush an irqwork the handler already queued, s...

CVE-2026-98661

The Linux kernel contains a vulnerability in the iio: light: rohm-bu27034 driver. When an integration-time read fails, the code incorrectly uses the resulting error code to compute the sleep time, potentially leading to an infinite delay . The issue is resolved by defaulting to the smallest integ...