CVE-2026-89941iio: buffer: Make IIO DMA fence release RCU-safe
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Make IIO DMA fence release RCU-safe The `dma_fence` documentation states that if a custom release implementation is provided, the `dma_fence` object must be freed in an RCU-safe way. The current `iio_dma_fence` implementation uses `kfree()`, which might result in a use-after-free. Remove the custom `release` implementation. This makes the DMA fence core fall back to `dma_fence_free()`, which calls `kfree_rcu()` on the fence. This requires that the fence be the first member of `struct iio_dma_fence`. Using the default release method for extended DMA fence structures is a common pattern.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f before 311595dc0b5621f74d8eb4dc38ef4efcdfe7e769; from 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f before 06a9460b8b792e109cbc934a856d02e5cff217ef; from 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f before 11cef99491117d4264603df159c4ff5f3845a059; from 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f before 8662e56c31cf23b61ca3d11b516efb94c35b8026 | CNA record |
References
- https://git.kernel.org/stable/c/311595dc0b5621f74d8eb4dc38ef4efcdfe7e769
- https://git.kernel.org/stable/c/06a9460b8b792e109cbc934a856d02e5cff217ef
- https://git.kernel.org/stable/c/11cef99491117d4264603df159c4ff5f3845a059
- https://git.kernel.org/stable/c/8662e56c31cf23b61ca3d11b516efb94c35b8026
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.