A boundary bug in the Linux kernel’s ADE9000 driver prevented the driver from scanning the highest status bit that represents Phase C dip events, causing those events to never be reported. The flaw can lead to inaccurate electrical measurements and potentially incorrect device behavior when updates to hardware state are not observed or logged. The weakness lies in an out‑of‑range control flow that skips a necessary event handling branch.

The issue affects Linux kernel code that drives ADE9000 energy‑measurement chips. Systems that compile the kernel with the iio: adc: ade9000 driver enabled are impacted. No specific version numbers are listed, but the patch is part of the kernel’s stable mainline series and ties to the commit that bumps the scanning limit to 26.

The vulnerability is functional and does not expose a direct exploitation path for remote attackers; it is inherently local and requires that the affected kernel code runs on the target machine. The patch is applied by updating the kernel source, and once built the issue is resolved. The EPSS score is < 1%, and the CVSS score of 3.3 reflects a low severity. The defect is not in the CISA KEV catalog, indicating a low external exploitation probability. The impact is limited to the accuracy of the data reported to user space and any applications that rely on those measurements.