CVE-2025-38133

iio: adc: ad4851: fix ad4858 chan pointer handling

State
Published
Severity
7.8 High
Published
Jul 3, 2025
Updated
Aug 5, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: ad4851: fix ad4858 chan pointer handling

The pointer returned from ad4851_parse_channels_common() is incremented internally as each channel is populated. In ad4858_parse_channels(), the same pointer was further incremented while setting ext_scan_type fields for each channel. This resulted in indio_dev->channels being set to a pointer past the end of the allocated array, potentially causing memory corruption or undefined behavior.

Fix this by iterating over the channels using an explicit index instead of incrementing the pointer. This preserves the original base pointer and ensures all channel metadata is set correctly.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 6250803fe2ec92be32a4df1c3a39c4a460d5bd58 to before 6c3b9e1167d072ce2d01cafec7866647cf8d3616Affected
  • 6250803fe2ec92be32a4df1c3a39c4a460d5bd58 to before 499a8cee812588905cc940837e69918c1649a19eAffected
LinuxLinux
  • 6.15Affected
  • before 6.15Not affected
  • 6.15.3 through 6.15.*Not affected
  • 6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.