PT-2026-64722 · Linux · Linux
CVE-2026-64501
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: ad sigma delta: fix CS held asserted and state leaks
In ad sigma delta single conversion(), set mode(AD SD MODE IDLE) and
disable one() were called from the out: block while keep cs asserted
was still true. This caused any SPI transfer issued by those callbacks
to carry cs change=1, leaving CS permanently asserted after the
conversion. Fix by moving both calls into the out unlock: block, after
keep cs asserted is cleared, matching the pattern already used in
ad sd calibrate().
In the error path of ad sd buffer postenable(), if an operation fails
after set mode(AD SD MODE CONTINUOUS) has already succeeded (e.g.
spi offload trigger enable()), the device is left in continuous
conversion mode with CS physically asserted. Additionally,
bus locked remaining true after spi bus unlock() causes subsequent
SPI operations to call spi sync locked() without the bus lock actually
held, allowing concurrent SPI access.
Fix the error path by clearing keep cs asserted first, then calling
set mode(AD SD MODE IDLE) to revert the device mode and deassert CS,
then clearing bus locked before releasing the bus.
For devices that implement neither set mode nor disable one (such as
MAX11205, which has no physical CS pin), no SPI transfer is issued
during cleanup and the cs change flag has no effect on any physical
line.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux