The Linux kernel's iio adc ad_sigma_delta driver had a vulnerability where the function ad_sigma_delta_clear_pending_event improperly handled devices without registers and without a ready GPIO signal. This caused the function to partially consume pending conversion results and corrupt the data stream. Additionally, when num_resetclks was zero, a memset operation with a negative length caused a heap overflow by writing SIZE_MAX bytes, corrupting heap memory. The patch fixes this by returning early when neither rdy_gpiod nor has_registers is set, which is safe for current registerless devices, and by adding explicit guards against zero-length data reads to prevent the overflow on devices with rdy_gpiod set but num_resetclks zero.

The vulnerability can cause heap corruption in the Linux kernel's iio adc ad_sigma_delta driver, potentially leading to memory corruption. This could affect system stability or security depending on how the corrupted heap memory is used. There is no indication of known exploits in the wild. The impact is limited to affected kernel driver code handling specific ADC devices without registers or with certain GPIO configurations.

A fix has been implemented in the Linux kernel to address this vulnerability by adding early return conditions and explicit guards to prevent heap overflow. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel-level issue, upgrading to a fixed kernel version is the recommended remediation. Patch status is not explicitly confirmed here; check the Linux kernel vendor advisory for the exact fixed versions and update accordingly.