VulnerabilityPublished 18 Oct 2026

CVE-2026-98664: Linux kernel · iio: imu: adis16400: fix unprotected debugfs reads

Source GCVE Database

Authoritative record:CVE-2026-98664

Not known to be exploited · fixed in f501302ebb9e1504162351b951fe3ae331c852ab : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in f501302ebb9e1504162351b951fe3ae331c852ab, e9b4c00f775a915b759b08bfe2c5e806a8301a59, d94787287a113a1326211647d5e0deed1e9de105 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-w4fg-xq8w-gq57

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ ae1d37a9bb4bd8d9091a40d153143e99b115ee37, < f501302ebb9e1504162351b951fe3ae331c852ab	Fixed in f501302ebb9e1504162351b951fe3ae331c852ab
LinuxLinux	Affected ≥ ae1d37a9bb4bd8d9091a40d153143e99b115ee37, < e9b4c00f775a915b759b08bfe2c5e806a8301a59	Fixed in e9b4c00f775a915b759b08bfe2c5e806a8301a59
LinuxLinux	Affected ≥ ae1d37a9bb4bd8d9091a40d153143e99b115ee37, < d94787287a113a1326211647d5e0deed1e9de105	Fixed in d94787287a113a1326211647d5e0deed1e9de105
LinuxLinux	Affected ≥ ae1d37a9bb4bd8d9091a40d153143e99b115ee37, < d3078aaef8af4648f94eeafde4b7b36efd9838d1	Fixed in d3078aaef8af4648f94eeafde4b7b36efd9838d1
LinuxLinux	Affected ≥ ae1d37a9bb4bd8d9091a40d153143e99b115ee37, < 50e8d70ba0743f88afd7e49f9cebd1841ee677f5	Fixed in 50e8d70ba0743f88afd7e49f9cebd1841ee677f5
LinuxLinux	Affected =5.8	Fixed in–

AI-suggested

A fix has been implemented in the Linux kernel source code by changing the debugfs file creation method for the serial_number file to debugfs_create_file(), which properly protects debugfs reads. Users should update to the fixed Linux kernel version containing this patch. No additional mitigations are indicated by the vendor advisory.

Description

A vulnerability in the Linux kernel's iio: imu: adis16400 driver involved unprotected debugfs reads due to improper handling of debugfs file operations. The issue was that adis16400_serial_number_fops did not call debugfs_file_get(), causing debugfs_remove_recursive() to not wait for ongoing reads before unbinding and freeing the device, potentially leading to use-after-free conditions. The vulnerability was fixed by changing the debugfs file creation method to debugfs_create_file(), aligning with other similar drivers and ensuring proper protection of debugfs reads.

Impact

The vulnerability could lead to a use-after-free condition when debugfs reads occur concurrently with device unbinding, potentially causing kernel memory corruption or system instability. No known exploits in the wild have been reported. The impact is limited to systems running the affected Linux kernel driver with debugfs enabled and accessible.

Summary

The Linux kernel vulnerability CVE-2026-98664 affected the iio: imu: adis16400 driver where the serial number debugfs file operations were not properly protected. Specifically, adis16400_serial_number_fops was open coded and did not invoke debugfs_file_get(), so debugfs_remove_recursive() could proceed without waiting for reads in progress, allowing the device to be unbound and freed underneath an active read operation. This was due to the use of debugfs_create_file_unsafe() for all three debugfs files after a commit that converted product_id and flash_count to DEFINE_DEBUGFS_ATTRIBUTE, which self-protects. The fix involved switching the serial_number debugfs file creation to debugfs_create_file(), consistent with other drivers like adis16475 and adis16550, thereby protecting against concurrent access issues.

References

Community reviews

Loading reviews…