CVE-2026-23092: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23092 is an out-of-bounds write vulnerability in the Linux kernel's IIO DAC ad3552r-hs driver, specifically in the ad3552r_hs_write_data_source function. The flaw arises because the code uses the user-supplied count parameter as the null-termination index instead of the actual bytes copied by simple_write_to_buffer(), causing a stack buffer overflow when count exceeds the fixed 64-byte buffer. Affected versions include Linux kernel 6.16 through 6.18.7 and release candidates 6.19-rc1 through 6.19-rc6. It was published on February 4, 2026, with patches released on March 17, 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Feedly, ZDI Advisory).

The root cause is classified as CWE-787 (Out-of-bounds Write). In ad3552r_hs_write_data_source, a fixed 64-byte stack buffer is populated via simple_write_to_buffer(), which returns the actual number of bytes copied. However, the code incorrectly uses the raw count argument (the user-requested write size) as the index for null termination (buf[count] = '\0'). If a user writes more than 64 bytes to the device node, count exceeds the buffer boundary, resulting in a stack out-of-bounds write. The bug was discovered via static analysis and validated under QEMU using KASAN (Kernel Address Sanitizer), and is analogous to a previously fixed issue in commit da9374819eb3 ("iio: backend: fix out-of-bound write") (Feedly).

A local attacker with low privileges can exploit this vulnerability by opening the ad3552r-hs device node and writing more than 64 bytes, triggering a stack buffer overflow. Consequences include system crash via stack corruption, disclosure of sensitive kernel memory contents, corruption of kernel data structures, and potential privilege escalation depending on what data is overwritten on the stack. All three CIA pillars are affected: confidentiality (kernel memory disclosure), integrity (data structure corruption), and availability (system crash) (Feedly).

A proof-of-concept advisory is publicly available via the Zero Day Initiative (ZDI-26-250), published March 31, 2026. Exploitation requires local access with low privileges and no user interaction. There is no current evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a low probability of near-term exploitation (ZDI Advisory, Feedly).

1. Reconnaissance: Identify a target system running Linux kernel versions 6.16–6.18.7 or 6.19-rc1 through 6.19-rc6 with the ad3552r-hs IIO DAC driver loaded and a corresponding device node (e.g., /dev/iio:deviceX) accessible.
2. Gain local access: Obtain a local shell with at least low-privilege user access on the target system.
3. Open the device node: Open the ad3552r-hs device node associated with the vulnerable driver (e.g., via the debugfs or sysfs interface exposed by the IIO subsystem).
4. Trigger the overflow: Write more than 64 bytes to the device node (e.g., 128 bytes of 'A'). This causes count (128) to be used as the null-termination index on a 64-byte stack buffer, writing '\0' 64 bytes past the buffer boundary.
5. Achieve objective: Depending on stack layout, the overflow may corrupt adjacent stack data, leading to a kernel crash (denial of service), kernel memory disclosure, or overwrite of a return address or function pointer enabling privilege escalation (ZDI Advisory, Feedly).

• Logs: KASAN (Kernel Address Sanitizer) reports in kernel logs (dmesg) indicating an out-of-bounds write in ad3552r_hs_write_data_source; kernel oops or BUG messages referencing the iio or ad3552r subsystem.
• Process: Unexpected write operations of large byte counts (>64 bytes) to IIO device nodes associated with the ad3552r-hs driver.
• File System: Unusual access patterns to /dev/iio:device* or related debugfs/sysfs entries by non-privileged users.
• Network: No network-based IOCs are expected, as this is a local exploitation vector.

The vulnerability is patched in Linux kernel versions 6.18.8 and 6.19-rc7 and later, via commits 978d28136c53df38f8f0b747191930e2f95e9084 and db16e7c52032c79156930a337ee17232931794ba on git.kernel.org. Organizations running affected versions (6.16–6.18.7 or 6.19-rc1 through 6.19-rc6) should upgrade immediately. As a temporary workaround, restrict local user access to ad3552r-hs device nodes (e.g., /dev/iio*) using file permissions or access control policies to prevent untrusted users from writing to these nodes (Feedly, Kernel Patch 1, Kernel Patch 2).

The Zero Day Initiative published advisory ZDI-26-250 on March 31, 2026, covering this vulnerability. Systemtek published a brief write-up in April 2026 characterizing it as a local privilege escalation in the Linux kernel Analog Device driver. The Yocto Project security mailing list also referenced the CVE in May 2026. Overall community reaction has been limited given the narrow scope of affected hardware and the local-only attack vector (ZDI Advisory).