CVE-2026-98666 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
iio: gyro: adis16136: fix unprotected debugfs reads
The serial_number file operations are open coded and never call debugfs_file_get(), which debugfs_create_file_unsafe() requires. debugfs_remove_recursive() therefore does not wait for a read in progress, and unbind frees the iio_dev underneath it.
Use debugfs_create_file() instead.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel's Industrial I/O subsystem contains a critical race condition vulnerability within the adis16136 gyroscope driver that stems from improper handling of debugfs file operations. This issue specifically affects the serial_number attribute, which is implemented using open-coded file operation structures rather than standard helper functions. The core technical flaw lies in the failure to invoke debugfs_file_get() during read operations. When a user space process initiates a read on this debugfs entry, the kernel does not increment the reference count for the underlying device structure. This omission violates the safety guarantees provided by the debugfs subsystem, which relies on these references to ensure that devices remain allocated while their associated files are actively accessed.
The operational consequence of this missing synchronization mechanism is a use-after-free vulnerability. When an administrator or automated tool unbinds the driver from its hardware device, the kernel proceeds with cleanup procedures including calling debugfs_remove_recursive(). Because no active reference was held by any ongoing read operation, the removal function does not wait for in-progress reads to complete. Consequently, the iio_dev structure is freed while a user space process may still be executing a read syscall that accesses memory within that now-deallocated object. This race condition allows an attacker with local access who can trigger rapid bind-unbind cycles during active debugfs reads to corrupt kernel memory or cause a system crash through a null pointer dereference or invalid memory access.
From a classification perspective, this vulnerability aligns closely with CWE-416, Use After Free, as the root cause is accessing freed memory due to improper lifecycle management of object references. In terms of attack vectors and techniques, it relates to ATT&CK technique T1059, Command and Scripting Interpreter, specifically in contexts where local privilege escalation or denial of service might be achieved by exploiting kernel instability. The vulnerability highlights the risks associated with using debugfs_create_file_unsafe() without adhering strictly to its requirements for manual reference counting via debugfs_file_get() and debugfs_file_put().
To mitigate this risk, developers must ensure that all custom file operations within debugfs entries properly manage object lifecycles by calling debugfs_file_get() at the start of open or read operations and debugfs_file_put() upon completion. The recommended fix involves replacing the unsafe creation method with debugfs_create_file(), which automatically handles reference counting internally, thereby preventing race conditions between device unbinding and active file access. System administrators should apply kernel updates that include this patch to eliminate the window for exploitation. Regular auditing of driver code against these synchronization requirements is essential to maintain system integrity in environments where hardware devices are frequently reconfigured or managed dynamically.