CVE-2026-31768: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31768 is a kernel memory safety vulnerability in the Linux kernel's TI ADC161S626 IIO ADC driver, where spi_read() uses non-DMA-safe stack memory for SPI buffers instead of properly allocated DMA-safe memory. This flaw affects Linux kernel versions from 4.9 up to (but not including) 6.1.168, 6.2–6.6.133, 6.7–6.12.80, 6.13–6.18.21, and 6.19–6.19.11, as well as 7.0 release candidates. It was published on May 1, 2026, with patches released across stable kernel branches. The CVSS v3.1 base score is 7.8 (High), reflecting local access with low privileges required (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-120 (Buffer Copy without Checking Size of Input / Classic Buffer Overflow), arising from the ti-adc161s626 driver's use of stack-allocated memory as SPI DMA transfer buffers. Linux SPI subsystem requires all transfer buffers to be DMA-safe (i.e., allocated from non-stack, DMA-coherent memory), because DMA controllers may not be able to access stack memory on certain architectures, leading to undefined behavior or kernel memory corruption. The fix replaces the stack-based __be16/__be32 buffers with a heap-allocated u8[] DMA-safe buffer and updates the associated conversion functions accordingly. Exploitation would require local access to a system with TI ADC161S626 hardware and a DMA-capable SPI controller (GitHub Advisory, Red Hat Bugzilla).

On systems equipped with TI ADC161S626 hardware and DMA-capable SPI controllers, this vulnerability can result in kernel memory corruption and system instability during SPI read operations. The high CVSS scores for confidentiality, integrity, and availability reflect the potential for a local attacker with low privileges to trigger kernel-level memory corruption, which could lead to privilege escalation, information disclosure of kernel memory contents, or system crashes (denial of service). The impact is limited to systems with the specific hardware combination; general-purpose servers without this ADC hardware are not affected (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for local access, low-privilege credentials, and the presence of specific TI ADC161S626 hardware with a DMA-capable SPI controller (GitHub Advisory, Red Hat Bugzilla).

Update the Linux kernel to a patched version: 6.1.168 or later (for the 4.9–6.1 branch), 6.6.134 or later, 6.12.81 or later, 6.18.22 or later, 6.19.12 or later, or 7.0 stable release. Multiple stable-branch patches are available via the kernel stable tree. For systems that cannot be immediately updated, consider disabling or blacklisting the ti-adc161s626 kernel module (modprobe -r ti-adc161s626) if the hardware is not in active use. Distribution-specific updates should be applied as they become available from vendors such as Red Hat (GitHub Advisory, Red Hat Bugzilla).