The Linux kernel's iio adc ad_sigma_delta driver had a vulnerability where the function ad_sigma_delta_clear_pending_event() improperly handled devices without registers and without a ready GPIO. The function fell through to a status register read path that, for such devices, caused ad_sd_read_reg() to skip the address byte and clock raw MISO bytes identical to reading conversion data. If a pending conversion result was present, this partially consumed it and corrupted the data stream for subsequent reads. Additionally, when num_resetclks was zero, a calculation led to a negative length in a memset call, causing a heap overflow by overwriting memory up to SIZE_MAX. The fix returns immediately when neither rdy_gpiod nor has_registers is set, preventing this unsafe operation. This vulnerability is tracked as CVE-2026-64502 and affects Linux kernel versions prior to 7.0.0-31.31 and related builds.

Successful exploitation could lead to heap corruption, which may cause system instability, crashes, or potentially allow an attacker with local access to escalate privileges or cause denial of service. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. However, exploitation requires local access and low privileges, with no known exploits in the wild at this time.

An official patch is available and should be applied by updating to Linux kernel versions 7.0.0-31.31 or later (and related patched builds). After updating, a system reboot is required. Due to ABI changes, third-party kernel modules must be recompiled and reinstalled. Follow the vendor advisory instructions for upgrading the kernel packages to the fixed versions. No additional mitigations are indicated by the vendor advisory.