Improper resource shutdown or release in Linux kernel - CVE-2026-64501

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ad_sigma_delta.c when handling error paths and conversion cleanup. A local user can trigger a failed conversion or buffer post-enable operation to cause a denial of service.

The issue can leave chip select physically asserted, leave the device in continuous conversion mode, and allow subsequent SPI operations to proceed without the bus lock actually being held.

Affected software

How to mitigate CVE-2026-64501

External References

• https://git.kernel.org/stable/c/c313bb7c38855e94ceef939d152dd75e5a904b5f
• https://git.kernel.org/stable/c/c72da0688575e5ef39c36bb44fed53aa18f8ae65
• https://git.kernel.org/stable/c/f1de829ee87a1198d3465493ce430d36c5fa029c

Related Security Bulletins

• Improper resource shutdown or release in Linux kernel iio adc driver