CVE-2026-98664

iio: imu: adis16400: fix unprotected debugfs reads

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: imu: adis16400: fix unprotected debugfs reads

adis16400_serial_number_fops is open coded and never calls debugfs_file_get(), so debugfs_remove_recursive() does not wait for a read in progress and unbind frees the iio_dev underneath it.

Commit ae1d37a9bb4b ("iio: imu: adis16400: use DEFINE_DEBUGFS_ATTRIBUTE instead of DEFINE_SIMPLE_ATTRIBUTE") converted product_id and flash_count to DEFINE_DEBUGFS_ATTRIBUTE, which protects itself, but moved all three files to debugfs_create_file_unsafe().

serial_number prints three registers as "%.4x-%.4x-%.4x" and DEFINE_DEBUGFS_ATTRIBUTE() formats a single u64, so it cannot be converted without changing what the file returns. adis16475 and adis16550 already use debugfs_create_file() for their open coded files. Use it here too.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ae1d37a9bb4bd8d9091a40d153143e99b115ee37 to before 48bb3c9b4a2fac64cb17c357418ebfbd4c9ac8ffAffected ae1d37a9bb4bd8d9091a40d153143e99b115ee37 to before 69cc001761894c65a0eef1bb6df911b39d30d71eAffected ae1d37a9bb4bd8d9091a40d153143e99b115ee37 to before d32eb2161b452a25b03f915f431bdcb9722cd92cAffected ae1d37a9bb4bd8d9091a40d153143e99b115ee37 to before d3078aaef8af4648f94eeafde4b7b36efd9838d1Affected ae1d37a9bb4bd8d9091a40d153143e99b115ee37 to before e9b4c00f775a915b759b08bfe2c5e806a8301a59Affected ae1d37a9bb4bd8d9091a40d153143e99b115ee37 to before 50e8d70ba0743f88afd7e49f9cebd1841ee677f5Affected ae1d37a9bb4bd8d9091a40d153143e99b115ee37 to before f501302ebb9e1504162351b951fe3ae331c852abAffected ae1d37a9bb4bd8d9091a40d153143e99b115ee37 to before d94787287a113a1326211647d5e0deed1e9de105Affected
LinuxLinux	5.8Affected before 5.8Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

ae1d37a9bb4bd8d9091a40d153143e99b115ee37 to before 48bb3c9b4a2fac64cb17c357418ebfbd4c9ac8ffAffected
ae1d37a9bb4bd8d9091a40d153143e99b115ee37 to before 69cc001761894c65a0eef1bb6df911b39d30d71eAffected
ae1d37a9bb4bd8d9091a40d153143e99b115ee37 to before d32eb2161b452a25b03f915f431bdcb9722cd92cAffected
ae1d37a9bb4bd8d9091a40d153143e99b115ee37 to before d3078aaef8af4648f94eeafde4b7b36efd9838d1Affected
ae1d37a9bb4bd8d9091a40d153143e99b115ee37 to before e9b4c00f775a915b759b08bfe2c5e806a8301a59Affected
ae1d37a9bb4bd8d9091a40d153143e99b115ee37 to before 50e8d70ba0743f88afd7e49f9cebd1841ee677f5Affected
ae1d37a9bb4bd8d9091a40d153143e99b115ee37 to before f501302ebb9e1504162351b951fe3ae331c852abAffected
ae1d37a9bb4bd8d9091a40d153143e99b115ee37 to before d94787287a113a1326211647d5e0deed1e9de105Affected

LinuxLinux

5.8Affected
before 5.8Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.