Kernel input validation error in the ad4030 analog‑to‑digital converter driver causes the driver to compute a logarithm on an oversampling_ratio value before confirming that the value is positive. When an attacker supplies zero or negative values, the ilog2() routine receives invalid input, producing an undefined result that can crash the kernel. The resulting kernel panic brings the affected system offline, creating a denial‑of‑service. The flaw is an improper input validation vulnerability (CWE‑1284).

All Linux kernel builds that compile the Industrial I/O (IIO) ad4030 driver are affected. Any system that contains the ad4030 driver module, regardless of exact kernel version, is vulnerable until the upstream patch is applied.

The CVSS score of 4.4 indicates moderate severity, and the EPSS score of <1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need local access that can supply oversampling_ratio values to the driver; no remote or publicly exposed interface is documented. If exploited, the kernel can crash, causing system reboot or halt.