A flaw in the Linux kernel ad_sigma_delta driver allows a local attacker to cause state leaks and improper SPI bus behavior, leading to potential system instability and unauthorized hardware interaction.

This vulnerability involves improper handling of the Chip Select (CS) state and bus locking mechanisms within the ad_sigma_delta ADC driver. A local authenticated user can trigger error paths that leave the SPI bus in an inconsistent state, allowing for concurrent SPI access and potential integrity or availability compromises.

The exploitation of this vulnerability could lead to system instability or denial of service due to the improper handling of SPI hardware communication. While the attack requires local access, the resulting integrity impact on hardware communication presents a risk to systems where SPI-connected peripherals are used for critical operations. The CVSS score of 7.1 reflects the high impact on system integrity and availability, even with the requirement for local privileges.

Immediate Action: Update the Linux kernel to version 6.18.39, 7.1.4, or later versions where the fix has been backported.

Proactive Monitoring: Monitor system logs for kernel-level SPI bus errors or unexpected device driver resets.

Compensating Controls: Restrict local system access to authorized personnel only to mitigate the risk posed by the required local privilege vector.

Public Exploit Available: Unknown

This vulnerability represents a significant stability and security risk for systems utilizing the affected ADC drivers. Security teams should prioritize patching the kernel to the recommended versions to ensure the SPI bus state remains consistent and protected against potential manipulation. Immediate attention is required to prevent local privilege exploitation of hardware communication channels.