CVE-2026-31768

Vulnerability

The vulnerability exists in the Linux kernel's Industrial I/O (IIO) subsystem, specifically in the TI ADC161S626 driver (ti-adc161s626.c). The driver's spi_read() function uses a stack-allocated buffer to receive data from the SPI device. However, the SPI subsystem requires all transfer buffers to be DMA-safe, as it may use DMA operations to read data. Stack memory does not guarantee DMA safety, leading to potential memory corruption or undefined behavior [1][2][3][4].

Exploitation

The issue is triggered during normal ADC read operations when the driver communicates with the hardware over SPI. An attacker would need either local access to the system or control over the SPI bus to influence the data being read. No authentication is required beyond access to the driver's operation path, but the attack surface is limited to systems that actually use the affected TI ADC chip.

Impact

Successful exploitation could lead to kernel memory corruption, potentially causing system crashes (denial of service) or, in more severe scenarios, arbitrary code execution in kernel context. The severity is rated High (CVSS 7.8), reflecting the potential for full system compromise, though the exact exploitability depends on hardware and kernel configuration.

Mitigation

The fix has been merged into the Linux kernel stable branches via commits referenced above [1][2][3][4]. Users should update their kernel to a version that includes these patches. No workaround is available; the only remedy is to apply the kernel update.