CVE-2026-46282 is a vulnerability in the Linux kernel's IIO frequency admv1013 driver where a NULL pointer dereference occurs if device_property_read_string() fails, leaving a string pointer uninitialized. The code then calls strcmp() on this uninitialized pointer, causing a kernel crash. The fix replaces the manual string read and comparison with device_property_match_property_string() and consolidates SE mode enums into a single sequential enum mapped to hardware registers. This vulnerability is included in a large set of Linux kernel security updates released by Ubuntu in July 2026. The vulnerability affects many specific kernel versions prior to 7.0.0-27.27, and a patch is available.

The vulnerability causes a NULL pointer dereference leading to a kernel crash (denial of service) when the affected driver processes device properties incorrectly. There is no indication of confidentiality or integrity impact. The CVSS vector indicates local attack vector with low privileges required, no user interaction, and an impact limited to availability (kernel crash). No known exploits in the wild have been reported.

A patch is available and should be applied by updating the Linux kernel to version 7.0.0-27.27 or later as provided by the vendor. After updating, a system reboot is required to apply the fix. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow the vendor's update instructions carefully.