CVE-2026-98668 iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iiopushtobufferswithtsunaligned leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled...

EUVD-2026-103922

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iiopushtobufferswithtsunaligned leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled...

CVE-2026-98668

The Linux kernel contains a vulnerability where the function iio_push_to_buffers_with_ts_unaligned() leaks uninitialized heap memory to userspace. This occurs when the data passed in is not a multiple of 8 bytes and the timestamp is enabled. The issue is resolved by specifying __GFP_ZERO for the ...

CVE-2026-98668 iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iiopushtobufferswithtsunaligned leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled...

CVE-2026-98667

The Linux kernel contains a vulnerability in the iio: frequency: adf4377 driver where the clk_init_data and clk_parent_data structures are not fully initialized. Specifically, the adf4377_clk_register() function fails to initialize init.parent_names and several members of the clk_parent_data stru...

CVE-2026-98667 iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data

In the Linux kernel, the following vulnerability has been resolved: iio: frequency: adf4377: Fully initialize clkinitdata and clkparentdata The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to...

EUVD-2026-103921

In the Linux kernel, the following vulnerability has been resolved: iio: frequency: adf4377: Fully initialize clkinitdata and clkparentdata The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to...

CVE-2026-98667 iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data

In the Linux kernel, the following vulnerability has been resolved: iio: frequency: adf4377: Fully initialize clkinitdata and clkparentdata The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to...

EUVD-2026-103920

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16136: fix unprotected debugfs reads The serialnumber file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does not wait for a read ...

CVE-2026-98666 iio: gyro: adis16136: fix unprotected debugfs reads

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16136: fix unprotected debugfs reads The serialnumber file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does not wait for a read ...

CVE-2026-98666

The Linux kernel contains a vulnerability in the iio: gyro: adis16136 driver. The serial_number file operations are open coded and fail to call debugfs_file_get(), which is required by debugfs_create_file_unsafe(). This issue allows debugfs_remove_recursive() to proceed without waiting for active...

CVE-2026-98666 iio: gyro: adis16136: fix unprotected debugfs reads

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16136: fix unprotected debugfs reads The serialnumber file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does not wait for a read ...

CVE-2026-98665 iio: health: max30102: fix NULL dereference in interrupt handler

In the Linux kernel, the following vulnerability has been resolved: iio: health: max30102: fix NULL dereference in interrupt handler The interrupt is requested in max30102probe and stays enabled for the lifetime of the device, but indiodev-activescanmask is only valid while a buffer is enabled...

CVE-2026-98665 iio: health: max30102: fix NULL dereference in interrupt handler

In the Linux kernel, the following vulnerability has been resolved: iio: health: max30102: fix NULL dereference in interrupt handler The interrupt is requested in max30102probe and stays enabled for the lifetime of the device, but indiodev-activescanmask is only valid while a buffer is enabled...

EUVD-2026-103919

In the Linux kernel, the following vulnerability has been resolved: iio: health: max30102: fix NULL dereference in interrupt handler The interrupt is requested in max30102probe and stays enabled for the lifetime of the device, but indiodev-activescanmask is only valid while a buffer is enabled...

CVE-2026-98665

The Linux kernel contains a NULL pointer dereference vulnerability within the iio: health: max30102 driver. The issue exists in the max30102_interrupt_handler because the indio_dev->active_scan_mask is only valid when a buffer is enabled, but the interrupt remains active for the device's lifet...

CVE-2026-98664 iio: imu: adis16400: fix unprotected debugfs reads

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprotected debugfs reads adis16400serialnumberfops is open coded and never calls debugfsfileget, so debugfsremoverecursive does not wait for a read in progress and unbind frees the iiodev underneath it...

CVE-2026-98664 iio: imu: adis16400: fix unprotected debugfs reads

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprotected debugfs reads adis16400serialnumberfops is open coded and never calls debugfsfileget, so debugfsremoverecursive does not wait for a read in progress and unbind frees the iiodev underneath it...

EUVD-2026-103918

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprotected debugfs reads adis16400serialnumberfops is open coded and never calls debugfsfileget, so debugfsremoverecursive does not wait for a read in progress and unbind frees the iiodev underneath it...

CVE-2026-98664

The Linux kernel contains a vulnerability in the iio: imu: adis16400 driver related to unprotected debugfs reads. Specifically, the adis16400_serial_number_fops is open-coded and fails to call debugfs_file_get(). This allows debugfs_remove_recursive() to proceed without waiting for active reads, ...