The ad_sigma_delta sub‑driver in the Linux IIO subsystem left the SPI chip‑select line permanently asserted after a conversion and failed to de‑assert it on error paths. In addition, the driver could leave the bus locked while the lock was no longer held, allowing concurrent SPI accesses. This behavior may leak internal state and can result in a denial‑of‑service by stalling the SPI bus or by allowing other drivers to perform unintended operations. The primary impact is a kernel‑level resource leak that could destabilize the system or expose sensitive data if the driver is part of a device that can be commanded by an attacker. The weakness is consistent with race‑condition and improper resource release flaws. An attacker who can run code with kernel privileges could trigger the error path to keep the device in continuous mode and lock the bus, potentially degrading system responsiveness or causing crashes.

This bug affects the Linux kernel by default, specifically the Industrial I/O ADC driver ad_sigma_delta in the IIO subsystem. The impacted drivers serve devices such as the MAX11205. Any kernel that contains the ad_sigma_delta driver is vulnerable, regardless of version, until the commits referenced in the advisory (c313bb7c, c72da068, f1de829e) are applied. The vendor is the Linux kernel, and the product is the IIO subsystem driver. (Version information was not supplied.)

The CVSS score is 7.1, while the EPSS score of < 1% indicates a very low probability that an attacker will actively exploit this vulnerability. The Advisory does not list the issue in the CISA KEV catalog. The vulnerability is local to the kernel: an attacker would need to execute privileged code or manipulate the SPI device to trigger the bad state. Because it resides in the kernel driver code, a successful exploit would require local privilege escalation or a separate kernel exploit. Given the low EPSS and lack of CVE exploitation reports, the overall risk is low to moderate, but the impact could be high if an attacker can exploit the driver to cause a denial of service.