CVE-2026-46282CWE-476

CVE-2026-46282

Medium · published June 8, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
5.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

iio: frequency: admv1013: fix NULL pointer dereference on str

When device_property_read_string() fails, str is left uninitialized

but the code falls through to strcmp(str, ...), dereferencing a garbage

pointer. Replace manual read/strcmp with

device_property_match_property_string() and consolidate the SE mode

enums into a single sequential enum, mapping to hardware register

values via a switch consistent with other bitfields in the driver.

Several cleanup patches have been applied to this driver recently so

this will need a manual backport.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.0th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-06-08T21:16Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel≥ 5.17, < 6.12.866.12.86
linux/linux_kernel≥ 6.13, < 6.18.276.18.27
linux/linux_kernel≥ 6.19, < 7.0.47.0.4
References (5)
EPSS history
Timeline
  • 08 JUN 15:41Z
    iio: frequency: admv1013: fix NULL pointer dereference on str
    cvelistv5