In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report… (CVE-2026-64500)
In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its interrupt handler with devm_request_irq() before it initializes st->completion with init_completion(). If an interrupt arrives after devm_request_irq() and before init_completion(), the handler calls complete() on an uninitialized completion, causing a kernel panic. The probe path, in lpc32xx_adc_probe(): iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */ ... retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0, LPC32XXAD_NAME, st); /* register handler */ ... init_completion(&st->completion); /* initialize completion */ lpc32xx_adc_isr() calls complete(): complete(&st->completion); If the device raises an interrupt before init_completion() runs, complete() acquires the uninitialized wait.lock and walks the zeroed task_list in swake_up_locked(). The zeroed task_list makes list_empty() return false, so swake_up_locked() dereferences a NULL list entry, triggering a KASAN wild-memory-access." Fix the chance of a spurious IRQ causing an uninitialized pointer dereference by moving init_completion() above devm_request_irq().
AI Analysis
Technical Summary
In the Linux kernel driver iio: adc: lpc32xx, the function lpc32xx_adc_probe() registered its interrupt handler via devm_request_irq() before initializing the completion structure with init_completion(). If an interrupt triggered before init_completion() was called, the interrupt handler lpc32xx_adc_isr() would call complete() on an uninitialized completion, leading to a kernel panic due to dereferencing a NULL list entry and causing a KASAN wild-memory-access. The vulnerability is fixed by moving the init_completion() call before devm_request_irq(), ensuring the completion is properly initialized before any interrupt can occur.
Potential Impact
If exploited, this vulnerability can cause a kernel panic due to a wild memory access triggered by the interrupt handler operating on an uninitialized completion structure. This results in a denial of service condition on affected systems running the vulnerable Linux kernel driver. There is no indication of code execution or privilege escalation from the provided data.
Mitigation Recommendations
A fix is available that reorders the initialization sequence in the Linux kernel driver source code, moving init_completion() before devm_request_irq(). Users and maintainers should apply the official Linux kernel patches that address this issue. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should check the official Linux kernel advisories or source repositories for the relevant fix.
In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report… (CVE-2026-64500)
Description
In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its interrupt handler with devm_request_irq() before it initializes st->completion with init_completion(). If an interrupt arrives after devm_request_irq() and before init_completion(), the handler calls complete() on an uninitialized completion, causing a kernel panic. The probe path, in lpc32xx_adc_probe(): iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */ ... retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0, LPC32XXAD_NAME, st); /* register handler */ ... init_completion(&st->completion); /* initialize completion */ lpc32xx_adc_isr() calls complete(): complete(&st->completion); If the device raises an interrupt before init_completion() runs, complete() acquires the uninitialized wait.lock and walks the zeroed task_list in swake_up_locked(). The zeroed task_list makes list_empty() return false, so swake_up_locked() dereferences a NULL list entry, triggering a KASAN wild-memory-access." Fix the chance of a spurious IRQ causing an uninitialized pointer dereference by moving init_completion() above devm_request_irq().
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In the Linux kernel driver iio: adc: lpc32xx, the function lpc32xx_adc_probe() registered its interrupt handler via devm_request_irq() before initializing the completion structure with init_completion(). If an interrupt triggered before init_completion() was called, the interrupt handler lpc32xx_adc_isr() would call complete() on an uninitialized completion, leading to a kernel panic due to dereferencing a NULL list entry and causing a KASAN wild-memory-access. The vulnerability is fixed by moving the init_completion() call before devm_request_irq(), ensuring the completion is properly initialized before any interrupt can occur.
Potential Impact
If exploited, this vulnerability can cause a kernel panic due to a wild memory access triggered by the interrupt handler operating on an uninitialized completion structure. This results in a denial of service condition on affected systems running the vulnerable Linux kernel driver. There is no indication of code execution or privilege escalation from the provided data.
Mitigation Recommendations
A fix is available that reorders the initialization sequence in the Linux kernel driver source code, moving init_completion() before devm_request_irq(). Users and maintainers should apply the official Linux kernel patches that address this issue. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should check the official Linux kernel advisories or source repositories for the relevant fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-h726-jm24-wvqc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64500"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6542069c2644c7f8081dc9
Added to database: 07/25/2026, 23:08:54 UTC
Last enriched: 07/25/2026, 23:13:43 UTC
Last updated: 09/07/2026, 10:52:10 UTC
Views: 38
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.