In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprotected debugfs reads adis16400_serial_number_fops… (CVE-2026-98664)

The Linux kernel vulnerability CVE-2026-98664 affected the iio: imu: adis16400 driver where the serial number debugfs file operations were not properly protected. Specifically, adis16400_serial_number_fops was open coded and did not invoke debugfs_file_get(), so debugfs_remove_recursive() could proceed without waiting for reads in progress, allowing the device to be unbound and freed underneath an active read operation. This was due to the use of debugfs_create_file_unsafe() for all three debugfs files after a commit that converted product_id and flash_count to DEFINE_DEBUGFS_ATTRIBUTE, which self-protects. The fix involved switching the serial_number debugfs file creation to debugfs_create_file(), consistent with other drivers like adis16475 and adis16550, thereby protecting against concurrent access issues.

The vulnerability could lead to a use-after-free condition when debugfs reads occur concurrently with device unbinding, potentially causing kernel memory corruption or system instability. No known exploits in the wild have been reported. The impact is limited to systems running the affected Linux kernel driver with debugfs enabled and accessible.

A fix has been implemented in the Linux kernel source code by changing the debugfs file creation method for the serial_number file to debugfs_create_file(), which properly protects debugfs reads. Users should update to the fixed Linux kernel version containing this patch. No additional mitigations are indicated by the vendor advisory.