AZL-109152 CVE-2026-98668 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iiopushtobufferswithtsunaligned leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled...

AZL-109361 CVE-2026-98670 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind The ZYNQ XADC alarm IRQ handler queues zynqunmaskwork via scheduledelayedwork; that work is cleared by a devm callback. Register the devm callback befo...

CVE-2026-98668

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iiopushtobufferswithtsunaligned leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled...

CVE-2026-98669

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: serialize buffer teardown with mode claims Buffer-mode claims hold mlock to guarantee that the device remains in buffer mode until the claim is released. Normal buffer updates take infoexistlock followed by mlock in...

CVE-2026-98670

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind The ZYNQ XADC alarm IRQ handler queues zynqunmaskwork via scheduledelayedwork; that work is cleared by a devm callback. Register the devm callback befo...

CVE-2026-98673

In the Linux kernel, the following vulnerability has been resolved: iio: adc: pac1934: check ACPI label duplication A label duplication failure currently reaches the terminating-byte write. Release the ACPI result and abort before accessing the missing label; earlier labels are managed by devres...

CVE-2026-98674

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adi-axi-adc: Initialize state mutex The AXI ADC register access paths serialize transactions with st-lock, but probe does not initialize it. Initialize the mutex before registering the backend...

CVE-2026-98676

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: fix NULL pointer dereference in clkout registration ade9000setupclkout passes NULL as the register address when registering a divider clock. During clock registration, the common clock framework calls...

CVE-2026-98671

In the Linux kernel, the following vulnerability has been resolved: iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure If devmthermalofzoneregister fails, probe returns without unregistering the IIO map array or disabling runtime PM. Jump to errmap to release them...

CVE-2026-98672

In the Linux kernel, the following vulnerability has been resolved: iio: adc: stm32-adc: fix possible division by zero in processed channel In case the conversion has failed or returned zero, processing val can lead to a division by zero. Need to check for errors, or converted value is zero, befo...

CVE-2026-98675

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: handle Phase C dip events in IRQ1 handler ADE9000ST1CROSSINGDEPTH is the exclusive upper bound for scanning the STATUS1 event bits, so a value of 25 left out the highest event bit, ADE9000ST1DIPCBIT bit 25. Pha...

AZL-108705 CVE-2026-98666 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16136: fix unprotected debugfs reads The serialnumber file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does not wait for a read ...

AZL-108960 CVE-2026-98663 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16480: fix unprotected debugfs reads The firmwarerevision and firmwaredate file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does...

AZL-109067 CVE-2026-98660 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup The sampling frequency tables store each frequency as an integer part and a fractional part in micro units. numsamplingfreqavail is initialized to the...

AZL-108587 CVE-2026-98662 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap020a00f: drain irqwork after freeirq The threaded IRQ handler queues data-work through irqworkqueue so the trigger is polled from a per-CPU context. freeirq does not flush an irqwork the handler already queued, s...

AZL-108623 CVE-2026-98657 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iiodevice left registered on PM setup failure pmruntimesetactive failing in probe jumps to errorunregbuffer, which only calls iiotriggeredbuffercleanup -- it does not undo the iiodeviceregister th...

AZL-108828 CVE-2026-98661 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: iio: light: rohm-bu27034: Fix infinite delay on error When reading an integration-time fails, the code will use error code to compute the sleep time. Fix this by using the smallest integration time as a default if reading fails...

AZL-108957 CVE-2026-98665 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: iio: health: max30102: fix NULL dereference in interrupt handler The interrupt is requested in max30102probe and stays enabled for the lifetime of the device, but indiodev-activescanmask is only valid while a buffer is enabled...

AZL-109127 CVE-2026-98664 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprotected debugfs reads adis16400serialnumberfops is open coded and never calls debugfsfileget, so debugfsremoverecursive does not wait for a read in progress and unbind frees the iiodev underneath it...

CVE-2026-98657

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iiodevice left registered on PM setup failure pmruntimesetactive failing in probe jumps to errorunregbuffer, which only calls iiotriggeredbuffercleanup -- it does not undo the iiodeviceregister th...