The Linux kernel vulnerability in the iio adc ad_sigma_delta driver involved improper handling of the chip select (CS) line during SPI transfers. Specifically, in ad_sigma_delta_single_conversion(), calls to set_mode(AD_SD_MODE_IDLE) and disable_one() were made while keep_cs_asserted was still true, causing SPI transfers to carry cs_change=1 and leaving the CS line permanently asserted after conversion. Additionally, in the error path of ad_sd_buffer_postenable(), failure after entering continuous conversion mode left the device in continuous mode with CS asserted and caused bus_locked to remain true after spi_bus_unlock(), allowing concurrent SPI access without proper locking. The fix moves cleanup calls after clearing keep_cs_asserted and properly resets device mode and bus lock state. Devices lacking physical CS pins are not affected by the cs_change flag issue.

The vulnerability could cause the SPI chip select line to remain asserted indefinitely, potentially disrupting SPI communication and leaving the device in an unintended continuous conversion mode. Furthermore, improper bus locking could allow concurrent SPI operations without proper synchronization, risking data corruption or undefined behavior in SPI transactions. Devices without physical CS pins are not impacted by the CS assertion issue.

A fix has been implemented in the Linux kernel to correct the order of operations in the ad_sigma_delta driver, ensuring the CS line is properly deasserted and bus locking is correctly managed. Users should update to the fixed Linux kernel version containing this patch. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation. Patch status is not explicitly confirmed here; check the vendor or Linux kernel advisory for the exact fixed versions and update guidance.