CVE-2026-98666

iio: gyro: adis16136: fix unprotected debugfs reads

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: gyro: adis16136: fix unprotected debugfs reads

The serial_number file operations are open coded and never call debugfs_file_get(), which debugfs_create_file_unsafe() requires. debugfs_remove_recursive() therefore does not wait for a read in progress, and unbind frees the iio_dev underneath it.

Use debugfs_create_file() instead.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	9aaea09b4cbdbe1a80ab3fa1a5d32c3ec61fa6e2 to before c325d98b824b61cf7761335c633bfac22ec8e85bAffected 9aaea09b4cbdbe1a80ab3fa1a5d32c3ec61fa6e2 to before c8cf798ad3ae0573e83c01c73228f5f46e54f1a0Affected 9aaea09b4cbdbe1a80ab3fa1a5d32c3ec61fa6e2 to before 3558b125b034003b04e89d0d7b38733a08d3fc49Affected 9aaea09b4cbdbe1a80ab3fa1a5d32c3ec61fa6e2 to before b62c3944c006cff85dad881ba2948b2f3ef5a626Affected 9aaea09b4cbdbe1a80ab3fa1a5d32c3ec61fa6e2 to before d5b0b62e26d7d30e0e16e2d695f2161f7e92a5a5Affected 9aaea09b4cbdbe1a80ab3fa1a5d32c3ec61fa6e2 to before b53dc6e15aead039bc6a5e08060c96786240c81dAffected 9aaea09b4cbdbe1a80ab3fa1a5d32c3ec61fa6e2 to before b05e768420352d9051f86c1a1f20f44fa046ba45Affected 9aaea09b4cbdbe1a80ab3fa1a5d32c3ec61fa6e2 to before 2b498df75d6c29aa3e760127ae0f0003df598b53Affected
LinuxLinux	4.16Affected before 4.16Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

9aaea09b4cbdbe1a80ab3fa1a5d32c3ec61fa6e2 to before c325d98b824b61cf7761335c633bfac22ec8e85bAffected
9aaea09b4cbdbe1a80ab3fa1a5d32c3ec61fa6e2 to before c8cf798ad3ae0573e83c01c73228f5f46e54f1a0Affected
9aaea09b4cbdbe1a80ab3fa1a5d32c3ec61fa6e2 to before 3558b125b034003b04e89d0d7b38733a08d3fc49Affected
9aaea09b4cbdbe1a80ab3fa1a5d32c3ec61fa6e2 to before b62c3944c006cff85dad881ba2948b2f3ef5a626Affected
9aaea09b4cbdbe1a80ab3fa1a5d32c3ec61fa6e2 to before d5b0b62e26d7d30e0e16e2d695f2161f7e92a5a5Affected
9aaea09b4cbdbe1a80ab3fa1a5d32c3ec61fa6e2 to before b53dc6e15aead039bc6a5e08060c96786240c81dAffected
9aaea09b4cbdbe1a80ab3fa1a5d32c3ec61fa6e2 to before b05e768420352d9051f86c1a1f20f44fa046ba45Affected
9aaea09b4cbdbe1a80ab3fa1a5d32c3ec61fa6e2 to before 2b498df75d6c29aa3e760127ae0f0003df598b53Affected

LinuxLinux

4.16Affected
before 4.16Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.