CVE Vulnerability Catalog

In the Linux kernel IIO kionix-kx022a driver, when a regmap operation fails in kx022a_fifo_enable(), the allocated sample memory is never freed and the state and previous hardware configuration are not reverted. This can leave WMI interrupts and buffers enabled or driver state flags incorrect.

In the Linux kernel IIO kxcjk-1013 driver, a repeated disable request calls kxcjk1013_set_power_state(data, false), dropping a runtime PM reference that was not acquired for this request. This can underflow the runtime PM usage count and trigger a "Runtime PM usage count underflow" warning.

In the Linux kernel IIO ad4030 driver, ad4030_set_avg_frame_len() computes the logarithm before validating the input. Passing zero or negative values leads to an undefined result from ilog2().

In the Linux kernel IIO ad_sigma_delta driver, samples_buf is allocated at runtime with devm_krealloc(), so its devres entry sits after all probe-time entries. On unbind, samples_buf is freed before iio_device_unregister() disables buffers, and the data ready IRQ is still enabled, allowing ad_sd_trigger_handler() to memcpy() samples into the freed buffer (use-after-free).

In the Linux kernel IIO ade9000 driver, ade9000_setup_clkout() passes NULL as the register address when registering a divider clock. The clock framework calls clk_divider_recalc_rate(), which dereferences the address via readl(), crashing when probing an ADE9000 configured as a clock provider with an external input clock.

In the Linux kernel IIO ade9000 driver, ADE9000_ST1_CROSSING_DEPTH was 25, the exclusive upper bound for scanning STATUS1 event bits, leaving out the highest bit ADE9000_ST1_DIPC_BIT (bit 25). Phase C dip events were never reported.

In the Linux kernel IIO adi-axi-adc driver, the AXI ADC register access paths serialize transactions with st->lock, but probe does not initialize this mutex before registering the backend.

In the Linux kernel, the iio: adc: pac1934 driver fails to check for ACPI label duplication. When label duplication fails, the code reaches the terminating-byte write, accessing a missing label. The issue was detected by static analysis.

In the Linux kernel, the iio: adc: stm32-adc driver has a possible division by zero in processed channel handling. If conversion fails or returns zero, processing the value can lead to division by zero. Errors or zero values must be checked before processing data.

In the Linux kernel, the iio: adc: sun4i-gpadc-iio driver fails to clean up on thermal zone registration failure. If devm_thermal_of_zone_register() fails, probe returns without unregistering the IIO map array or disabling runtime PM. It should jump to err_map to release them.

In the Linux kernel, the iio: adc: xilinx-xadc driver has an issue with resource release ordering on unbind. The ZYNQ XADC alarm IRQ handler queues zynq_unmask_work, which is cleared by a devm callback. The devm callback must be registered before devm_request_irq() so the IRQ is freed first. Otherwise the handler could re-arm the work and run it after the xadc structure has been freed.

In the Linux kernel, the iio: buffer subsystem has an issue with serializing buffer teardown with mode claims. Buffer-mode claims hold mlock to guarantee the device remains in buffer mode until the claim is released. However, iio_device_unregister() disables and deactivates all buffers without taking mlock, which can invalidate buffer state, including active_scan_mask, while a buffer-mode claim is held. mlock should be taken in iio_disable_all_buffers().

In the Linux kernel, the iio: buffer subsystem leaks uninitialized heap memory to userspace. The iio_push_to_buffers_with_ts_unaligned() function exposes uninitialized data when the passed data is not a multiple of 8 bytes and the timestamp is enabled. __GFP_ZERO should be used in devm_krealloc() to clear extra space.

In the Linux kernel, the iio: frequency: adf4377 driver has an issue with incomplete initialization of clk_init_data and clk_parent_data structures. The clk_init_data structure contains mutually exclusive members, and incomplete initialization may cause subtle issues exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled. adf4377_clk_register() assumes init.parent_names is NULL, but it is uninitialized, which may cause a crash.

In the Linux kernel, the iio: gyro: adis16136 driver has unprotected debugfs reads. The serial_number file operations are open coded and never call debugfs_file_get(), which debugfs_create_file_unsafe() requires. As a result, debugfs_remove_recursive() does not wait for a read in progress, and unbind frees the iio_dev underneath it. debugfs_create_file() should be used instead.

In the Linux kernel, the iio: health: max30102 driver has a NULL dereference in the interrupt handler. The interrupt is requested in max30102_probe() and stays enabled for the lifetime of the device, but indio_dev->active_scan_mask is only valid while a buffer is enabled. When an interrupt arrives while no buffer is enabled, the handler dereferences the NULL active_scan_mask, causing a kernel crash. max30102_fifo_count() should be called at the top of the handler and return early unless it reports a FIFO sample is ready.

In the Linux kernel, the iio: imu: adis16400 driver has unprotected debugfs reads. The adis16400_serial_number_fops structure is open coded and never calls debugfs_file_get(), so debugfs_remove_recursive() does not wait for a read in progress and unbind frees the iio_dev underneath it. A previous change converted product_id and flash_count to DEFINE_DEBUGFS_ATTRIBUTE but moved all three files to debugfs_create_file_unsafe(). The serial_number file prints three registers and cannot be converted without changing what the file returns. debugfs_create_file() should be used.

In the Linux kernel, the iio: imu: adis16480 driver uses open-coded debugfs file operations for firmware_revision and firmware_date that never call debugfs_file_get(), which debugfs_create_file_unsafe() requires. As a result, debugfs_remove_recursive() does not wait for an in-progress read, and unbind frees the iio_dev underneath it.

In the Linux kernel, the iio: light: gp2ap020a00f driver queues work via irq_work_queue(), but free_irq() does not flush an already queued irq_work. After gp2ap020a00f_remove() returns, that work may still run and call iio_trigger_poll() on data->trig, which devm cleanup has already freed, causing a use-after-free.

In the Linux kernel, the iio: light: rohm-bu27034 driver uses an error code to compute the sleep time when reading the integration time fails, which can lead to an infinite delay.