VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Dec 27, 2024· Updated Apr 18, 2026

CVE-2024-56557

CVE-2024-56557

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer

The AD7923 was updated to support devices with 8 channels, but the size of tx_buf and ring_xfer was not increased accordingly, leading to a potential buffer overflow in ad7923_update_scan_mode().

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Buffer overflow in Linux kernel's AD7923 ADC driver due to insufficient buffer size when supporting 8 channels, leading to memory corruption.

The AD7923 ADC driver in the Linux kernel was updated to support devices with 8 channels, but the tx_buf and ring_xfer buffers were not enlarged accordingly. This oversight causes a potential buffer overflow in the ad7923_update_scan_mode() function, which can corrupt adjacent kernel memory [1].

The vulnerability resides in the IIO (Industrial I/O) subsystem's scan mode update path. An attacker would need the ability to trigger the update_scan_mode callback, which typically requires local system access or control over a malicious IIO device configured with an excessive number of channels. The overflow occurs when copying data into the undersized buffers during channel configuration.

A successful buffer overflow can lead to memory corruption, potentially causing system instability or a crash. In a worst-case scenario, an attacker with local privileges could exploit this to achieve arbitrary code execution in kernel context, resulting in full system compromise.

The fix has been committed to the Linux kernel stable repository [1][2]. Users are advised to update to a patched kernel version containing the corrected buffer sizes. No workaround is available; the affected driver is part of the IIO subsystem and must be updated.

References
  1. Making sure you're not a bot!
  2. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

100

Patches

4
00663d3e000c
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
e5cac3272199
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
218ecc359491
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
3a4187ec454e
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.