Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: add bounds check to pga_settings index… (CVE-2026-53386)

The Linux kernel vulnerability CVE-2026-53386 involves an out-of-bounds array access in the iio ADC driver for the ti-ads1298 device. The ads1298_pga_settings array contains 7 elements, but the ADS1298_MASK_CH_PGA mask can yield values from 0 to 7. If the value is 7 or higher, it causes an out-of-bounds access. The fix adds a bounds check that returns an error (-EINVAL) if the index is out of range. This vulnerability was resolved in the Linux kernel updates provided in Ubuntu's hardware enablement edge kernels prior to version 7.0.0-31.31 and related builds. The CVSS 3.1 score is 7.8, indicating high impact on confidentiality, integrity, and availability with local attack vector and low complexity.

If exploited, this vulnerability could allow a local attacker with limited privileges to cause out-of-bounds memory access, potentially leading to memory corruption, privilege escalation, or system compromise. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability. However, no known exploits are reported in the wild. The vulnerability affects specific Linux kernel versions used in Ubuntu hardware enablement edge releases.

A patch is available and should be applied by updating to Linux kernel versions 7.0.0-31.31 or later as provided by Ubuntu security notices USN-8726-1 and USN-8727-1. After updating, a system reboot is required. Due to ABI changes, third-party kernel modules must be recompiled and reinstalled. Standard system upgrades will handle this automatically unless kernel metapackages were manually removed. No additional mitigation is required beyond applying the official update.