CVE-2026-64602: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-64602 is a race condition vulnerability in the Linux kernel's IIO ADC SPEAr driver (drivers/iio/adc/spear_adc.c) that can cause a kernel panic via an uninitialized completion structure dereference. The flaw exists because spear_adc_probe() registers its interrupt handler via devm_request_irq() before calling init_completion() to initialize the st->completion object. If a hardware interrupt fires in the window between these two operations, the handler invokes complete() on an uninitialized structure, triggering a KASAN wild-memory-access and kernel panic. The vulnerability affects Linux kernel versions from 3.16 up to the patched stable releases, and was published on August 6, 2026. The CVSS category is estimated as Medium (GitHub Advisory, Feedly).

The root cause is a time-of-check/time-of-use race condition (CWE-362) in the probe function of the SPEAr ADC driver. The st structure is allocated via devm_iio_device_alloc() (which zero-initializes memory), but init_completion() has not yet been called when devm_request_irq() enables the interrupt handler spear_adc_isr(). If an interrupt arrives during this window, complete() is called on the zeroed st->completion, causing swake_up_locked() to evaluate the zeroed task_list as non-empty (since list_empty() returns false on a zeroed list), and subsequently dereference a NULL list entry — triggering a kernel panic. The fix moves init_completion() above devm_request_irq() to eliminate the race window (GitHub Advisory).

Successful exploitation results in a kernel panic and complete system crash, constituting a Denial of Service (DoS) against the affected host. An unprivileged local user with the ability to trigger a hardware interrupt on a system using the SPEAr ADC driver — or on systems where spurious interrupts can occur naturally during device probe — can cause the crash. There is no evidence of confidentiality or integrity impact; the sole consequence is loss of availability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.164%, reflecting a low probability of exploitation in the near term. Exploitation requires local access and the presence of the SPEAr ADC hardware or a system susceptible to spurious interrupts during driver probe (GitHub Advisory, Feedly).

• Logs: Kernel panic messages in /var/log/kern.log or dmesg output referencing spear_adc, spear_adc_isr, complete(), or swake_up_locked(); KASAN reports indicating wild-memory-access or NULL pointer dereference in the IIO ADC subsystem.
• System Behavior: Unexpected system reboots or kernel oops events on systems equipped with SPEAr ADC hardware, particularly during device initialization or driver probe phases.

Apply the kernel patch that moves init_completion(&st->completion) above devm_request_irq() in spear_adc_probe(). Fixed versions are available across multiple stable branches: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2 (mainline). Administrators should update to one of these patched versions as the primary remediation. As a temporary measure on systems where the SPEAr ADC driver is not required, blacklisting the spear_adc kernel module can prevent the vulnerable code path from executing (GitHub Advisory).