SB20261022271 - NULL pointer dereference in Linux kernel iio adc driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-98676)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to a null pointer dereference in ade9000_setup_clkout() when probing an ADE9000 configured as a clock provider with an external input clock. A local privileged user can trigger probing of the affected device, if permitted, to cause a kernel crash because the divider clock is registered with a null register address that clk_divider_recalc_rate() dereferences through readl().

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/134aa31a8d4e71f6ab1d155ad7b4502508832f72
• https://git.kernel.org/stable/c/49ee1c6a3ebda6b7de06b2961b0e09c1c3fe536a
• https://git.kernel.org/stable/c/d2400175228fbc10b29c49a7b5f70a7e80d144dd