The Linux kernel’s iio: imu: adis16400 driver contained an unprotected read path on the debugfs serial number file. The file handler was implemented as open‑coded C code that never invoked debugfs_file_get(), meaning that when debugfs_remove_recursive() released the IIO device the file could still be read. An attacker could trigger a read while the driver is being unbound and thus observe data from memory that belongs to a freed iio_dev. This race condition exposes the contents of three device registers formatted as a serial number, providing sensitive hardware state information and potentially enabling a use‑after‑free exploitation scenario. The core weakness is an unprotected debugfs read that can occur during a device unbind operation.

Any system running a Linux kernel that includes the adis16400 IIO device driver and has debugfs enabled is affected. The flaw exists in the kernel source before the commit that introduces DEFINE_DEBUGFS_ATTRIBUTE and the safe debugfs_create_file() call; most mainstream distributions that ship older kernels until the fix commit expose the vulnerability.

The CVSS score is 4.1, and the EPSS score of < 1 % indicates a very low probability of exploitation. The vulnerability is not included in the CISA KEV catalog. Based on the description it is inferred that the attack vector is local, requiring read access to the debugfs filesystem. A privileged or local user with access to /sys/kernel/debug/iio/devices/ can trigger the race between a device read and an unbind, potentially leaking sensitive register values or exhausting the device object. While the evident impact is information disclosure, the race condition could also lead to a use‑after‑free, raising the severity for systems that allow unprivileged debugfs access.