VulnerabilityPublished 18 Oct 2026Updated 21 Oct 2026

CVE-2026-98664: Linux kernel · iio: imu: adis16400: fix unprotected debugfs reads

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in f501302ebb9e1504162351b951fe3ae331c852ab : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:18 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in f501302ebb9e1504162351b951fe3ae331c852ab, e9b4c00f775a915b759b08bfe2c5e806a8301a59, d94787287a113a1326211647d5e0deed1e9de105 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ ae1d37a9bb4bd8d9091a40d153143e99b115ee37, < f501302ebb9e1504162351b951fe3ae331c852ab	Fixed in f501302ebb9e1504162351b951fe3ae331c852ab
LinuxLinux	Affected ≥ ae1d37a9bb4bd8d9091a40d153143e99b115ee37, < e9b4c00f775a915b759b08bfe2c5e806a8301a59	Fixed in e9b4c00f775a915b759b08bfe2c5e806a8301a59
LinuxLinux	Affected ≥ ae1d37a9bb4bd8d9091a40d153143e99b115ee37, < d94787287a113a1326211647d5e0deed1e9de105	Fixed in d94787287a113a1326211647d5e0deed1e9de105
LinuxLinux	Affected ≥ ae1d37a9bb4bd8d9091a40d153143e99b115ee37, < d3078aaef8af4648f94eeafde4b7b36efd9838d1	Fixed in d3078aaef8af4648f94eeafde4b7b36efd9838d1
LinuxLinux	Affected ≥ ae1d37a9bb4bd8d9091a40d153143e99b115ee37, < 50e8d70ba0743f88afd7e49f9cebd1841ee677f5	Fixed in 50e8d70ba0743f88afd7e49f9cebd1841ee677f5
LinuxLinux	Affected =5.8	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprotected debugfs reads adis16400_serial_number_fops is open coded and never calls debugfs_file_get(), so debugfs_remove_recursive() does not wait for a read in progress and unbind frees the iio_dev underneath it. Commit ae1d37a9bb4b ("iio: imu: adis16400: use DEFINE_DEBUGFS_ATTRIBUTE instead of DEFINE_SIMPLE_ATTRIBUTE") converted product_id and flash_count to DEFINE_DEBUGFS_ATTRIBUTE, which protects itself, but moved all three files to debugfs_create_file_unsafe(). serial_number prints three registers as "%.4x-%.4x-%.4x" and DEFINE_DEBUGFS_ATTRIBUTE() formats a single u64, so it cannot be converted without changing what the file returns. adis16475 and adis16550 already use debugfs_create_file() for their open coded files. Use it here too.

References

Community reviews

Loading reviews…