CVE-2026-98674 iio: adc: adi-axi-adc: Initialize state mutex

Not scored Published 18 Oct 2026 Updated 19 Oct 2026

A missing mutex initialization in the Linux kernel AXI ADC driver can cause a null pointer dereference, leading to a system crash.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-98674?

CVE-2026-98674 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: adi-axi-adc: Initialize state mutex

The AXI ADC register access paths serialize transactions with st->lock, but probe does not initialize it. Initialize the mutex before registering the backend.

Which versions are affected by CVE-2026-98674?

How do I fix CVE-2026-98674?

Apply the vendor's patch.

Is CVE-2026-98674 being exploited?

There is no known exploitation of CVE-2026-98674 in the wild and no public exploit code.

Sources

Also known as BELL-CVE-2026-98674, DEBIAN-CVE-2026-98674, GHSA-ch3p-cm23-p6q5, UBUNTU-CVE-2026-98674.