CVE-2026-64500

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: adc: lpc32xx: Initialize completion before requesting IRQ<br /> <br /> In the report from Jaeyoung Chung:<br /> <br /> "lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its<br /> interrupt handler with devm_request_irq() before it initializes<br /> st-&gt;completion with init_completion(). If an interrupt arrives after<br /> devm_request_irq() and before init_completion(), the handler calls<br /> complete() on an uninitialized completion, causing a kernel panic.<br /> <br /> The probe path, in lpc32xx_adc_probe():<br /> <br /> iodev = devm_iio_device_alloc(&amp;pdev-&gt;dev, sizeof(*st)); /* st kzalloc-zeroed */<br /> ...<br /> retval = devm_request_irq(&amp;pdev-&gt;dev, irq, lpc32xx_adc_isr, 0,<br /> LPC32XXAD_NAME, st); /* register handler */<br /> ...<br /> init_completion(&amp;st-&gt;completion); /* initialize completion */<br /> <br /> lpc32xx_adc_isr() calls complete():<br /> <br /> complete(&amp;st-&gt;completion);<br /> <br /> If the device raises an interrupt before init_completion() runs,<br /> complete() acquires the uninitialized wait.lock and walks the zeroed<br /> task_list in swake_up_locked(). The zeroed task_list makes list_empty()<br /> return false, so swake_up_locked() dereferences a NULL list entry,<br /> triggering a KASAN wild-memory-access."<br /> <br /> Fix the chance of a spurious IRQ causing an uninitialized pointer<br /> dereference by moving init_completion() above devm_request_irq().