CVE-2025-71199

iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver

published February 4, 2026

CVSS
—
EPSS
0%
Percentile
9.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver

at91_adc_interrupt can call at91_adc_touch_data_handler function

to start the work by schedule_work(&st->touch_st.workq).

If we remove the module which will call at91_adc_remove to

make cleanup, it will free indio_dev through iio_device_unregister but

quite a bit later. While the work mentioned above will be used. The

sequence of operations that may lead to a UAF bug is as follows:

CPU0 CPU1

| at91_adc_workq_handler

at91_adc_remove |

iio_device_unregister(indio_dev) |

//free indio_dev a bit later |

| iio_push_to_buffers(indio_dev)

| //use indio_dev

Fix it by ensuring that the work is canceled before proceeding with

the cleanup in at91_adc_remove.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00203 · 9.7th percentile
Published
2026-02-04T16:07Z
EPSS history
Timeline
  • 04 FEB 16:07Z
    iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
    cvelistv5