CVE-2026-98677

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: ad sigma delta: fix use-after-free on unbind

ad sd buffer postenable() allocates sigma delta->samples buf with devm krealloc() at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources are released in reverse allocation order, which means unbind frees samples buf before iio device unregister() disables the buffers and detaches the trigger pollfunc. The data ready IRQ is still enabled at that point, so ad sd trigger handler() can still run and memcpy() incoming samples into the freed samples buf.

Fix this by preallocating the buffer in devm ad sd setup buffer and trigger(), before the triggered buffer and the IRQ are set up, so it is freed only after iio device unregister() has drained the trigger handler via free irq(). Size it for the worst case of all sequencer slots being active; ad sd validate scan mask() already caps the number of active channels at num slots.

This issue was found by an in-house static analysis tool.