SB20261022265 - Incomplete cleanup in Linux kernel iio adc driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261022265

SB20261022265 - Incomplete cleanup in Linux kernel iio adc driver

Published: October 22, 2026

Security Bulletin ID SB20261022265
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Incomplete cleanup (CVE-ID: CVE-2026-98671)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to potentially cause a denial of service through incomplete driver cleanup.

The vulnerability exists due to incomplete cleanup in the Linux kernel sun4i-gpadc-iio driver's probe function when thermal zone registration fails with an error other than -ENODEV. A local user can potentially trigger this failure path to leave the IIO map array registered and runtime power management enabled, which may disrupt system operation.


Remediation

Install update from vendor's website.

References