CVE-2025-39786: 
Linux Debian vulnerability analysis and mitigation

A vulnerability has been identified in the Linux kernel's Industrial I/O (IIO) subsystem, specifically in the AD7173 ADC driver. The issue relates to incorrect channel indexing when accessing the syscalib_mode attribute. The vulnerability was disclosed on September 11, 2025, affecting the Linux kernel's AD7173 ADC driver implementation (NVD).

The vulnerability stems from a mismatch between the address field (0-based index) used throughout the driver and the channels field in the device tree configuration. This inconsistency in indexing could lead to out-of-bounds access when looking up channels in the ad7173channels array while accessing the syscalibmode attribute (NVD).

The out-of-bounds access vulnerability in the AD7173 ADC driver could potentially lead to memory access violations in the Linux kernel. According to Red Hat's assessment, the vulnerability has received a CVSS v3 Base Score of 5.5 (Red Hat Portal).

The vulnerability has been addressed through patches in the Linux kernel. Two specific commits have been made to fix the channel index issue for syscalib_mode (Kernel Commit 1, Kernel Commit 2).