CVE-2026-46282

iio: frequency: admv1013: fix NULL pointer dereference on str

MEDIUM
5.5
CVSS Score
Published: June 8, 2026 at 03:41 PM UTC
Updated: October 21, 2026 at 01:19 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: iio: frequency: admv1013: fix NULL pointer dereference on str When device_property_read_string() fails, str is left uninitialized but the code falls through to strcmp(str, ...), dereferencing a garbage pointer. Replace manual read/strcmp with device_property_match_property_string() and consolidate the SE mode enums into a single sequential enum, mapping to hardware register values via a switch consistent with other bitfields in the driver. Several cleanup patches have been applied to this driver recently so this will need a manual backport.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.17 ≤ v < 6.12.866.13 ≤ v < 6.18.276.19 ≤ v < 7.0.45.17da35a7b526d9b258a2cb8b7816f736a41b32176b
Vendor states this is fixed in 2dc8d26690bf4e7226409563221c37bc095c94ff (fixed)
Vendor states this is fixed in 3a9d8ec2051c2d80158ed7bded5e158c42870037 (fixed)
Vendor states this is fixed in 5e9f1bad26df3d3afb3cbbfa408b6d6e809708ac (fixed)
Vendor states this is fixed in aac0a51b16700b403a55b67ba495de021db78763 (fixed)
Vendor states this is fixed in 5.17 (unaffected)
Vendor states this is fixed in 6.12.86 (unaffected)
Vendor states this is fixed in 6.18.27 (unaffected)
Vendor states this is fixed in 6.6.160 (unaffected)
Vendor states this is fixed in 7.0.4 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card