CVE-2026-64500 iio: adc: lpc32xx: Initialize completion before requesting IRQ
A race condition in the LPC32xx ADC driver causes a kernel panic via null pointer dereference if an interrupt occurs before completion initialization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64500?
CVE-2026-64500 is a vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: lpc32xx: Initialize completion before requesting IRQ
In the report from Jaeyoung Chung:
"lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its interrupt handler with devm_request_irq() before it initializes st->completion with init_completion(). If an interrupt arrives after devm_request_irq() and before init_completion(), the handler calls complete() on an uninitialized completion, causing a kernel panic.
The probe path, in lpc32xx_adc_probe():
iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */ ... retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0, LPC32XXAD_NAME, st); /* register handler */ ... init_completion(&st->completion); /* initialize completion */
lpc32xx_adc_isr() calls complete():
complete(&st->completion);
If the device raises an interrupt before init_completion() runs, complete() acquires the uninitialized wait.lock and walks the zeroed task_list in swake_up_locked(). The zeroed task_list makes list_empty() return false, so swake_up_locked() dereferences a NULL list entry, triggering a KASAN wild-memory-access."
Fix the chance of a spurious IRQ causing an uninitialized pointer dereference by moving init_completion() above devm_request_irq().
Which versions are affected by CVE-2026-64500?
How do I fix CVE-2026-64500?
Apply the vendor's patch.
Is CVE-2026-64500 being exploited?
There is no known exploitation of CVE-2026-64500 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-64500, DEBIAN-CVE-2026-64500, GHSA-h726-jm24-wvqc, ROOT-OS-UBUNTU-2204-CVE-2026-64500, UBUNTU-CVE-2026-64500.