{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89941","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-11T19:38:34.777Z","datePublished":"2026-09-16T10:32:29.148Z","dateUpdated":"2026-09-16T14:40:28.158Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-16T14:40:28.158Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: buffer: Make IIO DMA fence release RCU-safe\n\nThe `dma_fence` documentation states that if a custom release\nimplementation is provided, the `dma_fence` object must be freed in an\nRCU-safe way. The current `iio_dma_fence` implementation uses `kfree()`,\nwhich might result in a use-after-free.\n\nRemove the custom `release` implementation. This makes the DMA fence core\nfall back to `dma_fence_free()`, which calls `kfree_rcu()` on the fence.\nThis requires that the fence be the first member of `struct iio_dma_fence`.\n\nUsing the default release method for extended DMA fence structures is a\ncommon pattern."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The use-after-free is reached only through local IIO character-device ioctls (IIO_BUFFER_GET_FD_IOCTL then IIO_BUFFER_DMABUF_ATTACH/ENQUEUE_IOCTL on /dev/iio:deviceN); there is no network, Bluetooth, or USB packet path into the IIO DMA fence release.\nAC:L - The attacker controls both sides of the race by enqueueing IIO DMA-BUF transfers that create and later kfree() the fence while concurrently waiting on or exporting the same dma-buf's reservation fences via DMA_BUF_IOCTL_SYNC/EXPORT_SYNC_FILE, so the missing RCU grace period is attacker-driven.\nPR:L - The IIO open and ioctl path performs no capability check; only filesystem access to /dev/iio:deviceN is required. On Android, automotive, and industrial/SDR systems that ship DMA-capable IIO converters, that node is commonly group-accessible to unprivileged sensor or application users.\nUI:N - The attacker opens the IIO device, attaches their own DMA-BUF, and issues enqueue and dma-buf sync/export ioctls themselves; no separate victim action is required.\nS:U - The freed iio_dma_fence lives in the host kernel heap and any resulting corruption stays within the same kernel security authority; this is not a VM escape or IOMMU/DMA boundary bypass.\nC:H - Immediate kfree() of the dma_fence lets concurrent dma_resv RCU walkers (dma_fence_get_rcu, dma_fence_driver_name) read the reclaimed slab object; per kernel scoring guidance a use-after-free is High confidentiality impact.\nI:H - The freed dma_fence contains ops function pointers, callback lists, and a spinlock used after free; reclaiming the object with attacker-controlled data yields write and control-flow hijack primitives, so integrity impact is High.\nA:H - Use-after-free of the fence from dma_fence_release or dma_resv iteration causes a kernel oops or panic even without a full exploit, so availability impact is High."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/industrialio-buffer.c"],"versions":[{"version":"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f","lessThan":"311595dc0b5621f74d8eb4dc38ef4efcdfe7e769","status":"affected","versionType":"git"},{"version":"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f","lessThan":"06a9460b8b792e109cbc934a856d02e5cff217ef","status":"affected","versionType":"git"},{"version":"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f","lessThan":"11cef99491117d4264603df159c4ff5f3845a059","status":"affected","versionType":"git"},{"version":"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f","lessThan":"8662e56c31cf23b61ca3d11b516efb94c35b8026","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/industrialio-buffer.c"],"versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","status":"unaffected","versionType":"semver"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.12.110"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.18.51"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.2.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.3-rc1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/311595dc0b5621f74d8eb4dc38ef4efcdfe7e769"},{"url":"https://git.kernel.org/stable/c/06a9460b8b792e109cbc934a856d02e5cff217ef"},{"url":"https://git.kernel.org/stable/c/11cef99491117d4264603df159c4ff5f3845a059"},{"url":"https://git.kernel.org/stable/c/8662e56c31cf23b61ca3d11b516efb94c35b8026"}],"title":"iio: buffer: Make IIO DMA fence release RCU-safe","x_generator":{"engine":"bippy-1.2.0"}}}}