CVE-2026-64500: iio: adc: lpc32xx: Initialize completion before requesting IRQ

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: lpc32xx: Initialize completion before requesting IRQ

In the report from Jaeyoung Chung:

"lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its
interrupt handler with devm_request_irq() before it initializes
st->completion with init_completion(). If an interrupt arrives after
devm_request_irq() and before init_completion(), the handler calls
complete() on an uninitialized completion, causing a kernel panic.

The probe path, in lpc32xx_adc_probe():

    iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */
    ...
    retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0,
                              LPC32XXAD_NAME, st);           /* register handler */
    ...
    init_completion(&st->completion);                       /* initialize completion */

lpc32xx_adc_isr() calls complete():

    complete(&st->completion);

If the device raises an interrupt before init_completion() runs,
complete() acquires the uninitialized wait.lock and walks the zeroed
task_list in swake_up_locked(). The zeroed task_list makes list_empty()
return false, so swake_up_locked() dereferences a NULL list entry,
triggering a KASAN wild-memory-access."

Fix the chance of a spurious IRQ causing an uninitialized pointer
dereference by moving init_completion() above devm_request_irq().

The Linux kernel CVE team has assigned CVE-2026-64500 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.12 with commit 7901b2a1453e48c9defff2c97c67d3089bf4df7a and fixed in 5.10.261 with commit 7090c0d29708ee305022d0ea7b37612b33242fa2
	Issue introduced in 4.12 with commit 7901b2a1453e48c9defff2c97c67d3089bf4df7a and fixed in 5.15.212 with commit 0e33587967b356519aa6f220b5b43c6976320397
	Issue introduced in 4.12 with commit 7901b2a1453e48c9defff2c97c67d3089bf4df7a and fixed in 6.1.178 with commit 1ddf7b6ffb8ebb22b92a184a9eaa76277ef0c7cd
	Issue introduced in 4.12 with commit 7901b2a1453e48c9defff2c97c67d3089bf4df7a and fixed in 6.6.145 with commit 820c4f15353efe9a9429ae86ccceeaf4e0e4e585
	Issue introduced in 4.12 with commit 7901b2a1453e48c9defff2c97c67d3089bf4df7a and fixed in 6.12.96 with commit 48eccc6caed4e62c0f199ab3a3772fa969cd3b2d
	Issue introduced in 4.12 with commit 7901b2a1453e48c9defff2c97c67d3089bf4df7a and fixed in 6.18.39 with commit 9e2e8b8cdfd37ae7c7a8a5c96c59e98a768731c4
	Issue introduced in 4.12 with commit 7901b2a1453e48c9defff2c97c67d3089bf4df7a and fixed in 7.1.4 with commit 2f18c5551aa97ca7f39dbb151c67c9053ccadc17
	Issue introduced in 4.12 with commit 7901b2a1453e48c9defff2c97c67d3089bf4df7a and fixed in 7.2-rc3 with commit e561b35633f450ee607e87a6401d97f156a0cd54

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64500
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/iio/adc/lpc32xx_adc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7090c0d29708ee305022d0ea7b37612b33242fa2
	https://git.kernel.org/stable/c/0e33587967b356519aa6f220b5b43c6976320397
	https://git.kernel.org/stable/c/1ddf7b6ffb8ebb22b92a184a9eaa76277ef0c7cd
	https://git.kernel.org/stable/c/820c4f15353efe9a9429ae86ccceeaf4e0e4e585
	https://git.kernel.org/stable/c/48eccc6caed4e62c0f199ab3a3772fa969cd3b2d
	https://git.kernel.org/stable/c/9e2e8b8cdfd37ae7c7a8a5c96c59e98a768731c4
	https://git.kernel.org/stable/c/2f18c5551aa97ca7f39dbb151c67c9053ccadc17
	https://git.kernel.org/stable/c/e561b35633f450ee607e87a6401d97f156a0cd54