CVE-2026-23092: iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source
In the Linux kernel, the following vulnerability has been resolved:
iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source
When simple_write_to_buffer() succeeds, it returns the number of bytes
actually copied to the buffer. The code incorrectly uses 'count'
as the index for null termination instead of the actual bytes copied.
If count exceeds the buffer size, this leads to out-of-bounds write.
Add a check for the count and use the return value as the index.
The bug was validated using a demo module that mirrors the original
code and was tested under QEMU.
Pattern of the bug:
- A fixed 64-byte stack buffer is filled using count.
- If count > 64, the code still does buf[count] = '\0', causing an
- out-of-bounds write on the stack.
Steps for reproduce:
- Opens the device node.
- Writes 128 bytes of A to it.
- This overflows the 64-byte stack buffer and KASAN reports the OOB.
Found via static analysis. This is similar to the
commit da9374819eb3 ("iio: backend: fix out-of-bound write")
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel driver memory-safety bug in the AD3552R-HS IIO DAC path. A write to a related device node can place a null byte beyond a fixed stack buffer. Impact is most relevant to systems using this specific hardware driver, not every Linux host.
Executive priority
Treat this as targeted kernel maintenance for systems using the affected DAC driver. It does not currently justify emergency enterprise-wide response based on the supplied evidence, but exposed embedded or control systems should be patched promptly.
Technical view
The vulnerable function uses the user-supplied count as the terminator index after simple_write_to_buffer(), instead of the actual bytes copied. When count exceeds the 64-byte stack buffer, the driver writes out of bounds. The source says this was found by static analysis and validated under QEMU with KASAN.
Likely exposure
Likely exposure is limited to Linux systems with the ad3552r-hs IIO DAC driver present and reachable through its device node. General-purpose Linux servers are less likely exposed unless this driver and hardware path are enabled.
Exploitation context
No active exploitation is reported in the provided sources, and the CVE is not listed as KEV. The bundle describes a local device-node write condition but does not provide evidence of remote exploitation or privilege escalation impact.
Researcher notes
The core issue is incorrect terminator placement after simple_write_to_buffer(). The source bundle lacks CVSS, CWE, exploitability analysis, and distribution package mapping. Avoid broader claims until vendor advisories clarify impact and fixed versions.
Mitigation direction
Apply a vendor kernel update containing the referenced stable fixes.
Check Linux distribution advisories for backported package versions.
Disable or avoid loading the driver if the hardware is unused.
Restrict write access to the relevant IIO device node.
Prioritize embedded or hardware-control systems using this DAC path.
Validation and detection
Identify hosts running affected Linux kernel versions or downstream backports.
Confirm whether the ad3552r-hs driver is built, loaded, or packaged.
Check whether relevant IIO device nodes are present and writable.
Compare vendor kernel source against the referenced stable commits.
Review kernel logs for memory-safety reports if testing was performed.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2026-23092 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
3Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Feb 4, 2026, 16:08 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.