In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta: fix use-after-free on unbind ad_sd_buffer_postenable()… (CVE-2026-98677)

The Linux kernel's iio adc ad_sigma_delta driver had a use-after-free vulnerability caused by the runtime allocation of the samples buffer (samples_buf) with devm_krealloc(). During unbind, devm resources are released in reverse order, causing samples_buf to be freed before iio_device_unregister() disables buffers and detaches the trigger poll function. Since the data ready IRQ remains enabled, the interrupt handler (ad_sd_trigger_handler) can still run and copy data into the freed buffer, causing use-after-free. The fix preallocates the buffer earlier in devm_ad_sd_setup_buffer_and_trigger(), ensuring it is freed only after free_irq() drains the trigger handler. This prevents the use-after-free condition. The vulnerability was discovered via an in-house static analysis tool.

This vulnerability could lead to use-after-free memory corruption in the kernel, potentially causing system instability or crashes. No information about exploitation in the wild or privilege escalation is provided.

A fix is available that preallocates the buffer earlier in the driver lifecycle to prevent use-after-free. Users should update to the fixed Linux kernel version containing this patch once released. No alternative mitigations are indicated.