The iio:adc:ti-adc161s626 driver in the Linux kernel used a stack buffer for its spi_read() operation, which is not DMA‑safe. During an SPI DMA transfer, this can cause data to be written to or read from memory locations outside the intended region, providing an opportunity for kernel memory corruption. The applied patch replaces the unsafe stack buffer with a DMA‑safe u8[] buffer and adjusts conversion logic to prevent the out‑of‑bounds access, addressing the buffer overflow weakness (CWE‑120).

Any Linux kernel build that includes the ti‑adc161s626 driver before the patch is released, particularly systems that enable the driver for hardware that performs SPI reads.

The CVSS score of 7.8 places this vulnerability in the high‑severity category, and the EPSS score of <1% indicates that exploitation is unlikely in the current environment. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local or physically present attacker able to trigger the spi_read operation, as the handler runs in kernel space; based on the description, it is inferred that such an attacker could create or accelerate a DMA transfer that exploits the unsafe buffer, potentially leading to kernel memory corruption, system instability, or privileged escalation.