CVE-2026-64501

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: adsigmadelta: fix CS held asserted and state leaks

In adsigmadeltasingleconversion(), setmode(ADSDMODEIDLE) and disableone() were called from the out: block while keepcsasserted was still true. This caused any SPI transfer issued by those callbacks to carry cschange=1, leaving CS permanently asserted after the conversion. Fix by moving both calls into the outunlock: block, after keepcsasserted is cleared, matching the pattern already used in adsd_calibrate().

In the error path of adsdbufferpostenable(), if an operation fails after setmode(ADSDMODECONTINUOUS) has already succeeded (e.g. spioffloadtriggerenable()), the device is left in continuous conversion mode with CS physically asserted. Additionally, buslocked remaining true after spibusunlock() causes subsequent SPI operations to call spisync_locked() without the bus lock actually held, allowing concurrent SPI access.

Fix the error path by clearing keepcsasserted first, then calling setmode(ADSDMODEIDLE) to revert the device mode and deassert CS, then clearing bus_locked before releasing the bus.

For devices that implement neither setmode nor disableone (such as MAX11205, which has no physical CS pin), no SPI transfer is issued during cleanup and the cs_change flag has no effect on any physical line.