SB2026072750 - Improper resource shutdown or release in Linux kernel iio adc driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-64501)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ad_sigma_delta.c when handling error paths and conversion cleanup. A local user can trigger a failed conversion or buffer post-enable operation to cause a denial of service.

The issue can leave chip select physically asserted, leave the device in continuous conversion mode, and allow subsequent SPI operations to proceed without the bus lock actually being held.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/c313bb7c38855e94ceef939d152dd75e5a904b5f
• https://git.kernel.org/stable/c/c72da0688575e5ef39c36bb44fed53aa18f8ae65
• https://git.kernel.org/stable/c/f1de829ee87a1198d3465493ce430d36c5fa029c