{"id":"CVE-2026-89941","state":"PUBLISHED","title":"iio: buffer: Make IIO DMA fence release RCU-safe","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: buffer: Make IIO DMA fence release RCU-safe\n\nThe `dma_fence` documentation states that if a custom release\nimplementation is provided, the `dma_fence` object must be freed in an\nRCU-safe way. The current `iio_dma_fence` implementation uses `kfree()`,\nwhich might result in a use-after-free.\n\nRemove the custom `release` implementation. This makes the DMA fence core\nfall back to `dma_fence_free()`, which calls `kfree_rcu()` on the fence.\nThis requires that the fence be the first member of `struct iio_dma_fence`.\n\nUsing the default release method for extended DMA fence structures is a\ncommon pattern.","publishedAt":"2026-09-16T10:32:29.148Z","updatedAt":"2026-10-19T08:55:15.605Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f","status":"affected","lessThan":"311595dc0b5621f74d8eb4dc38ef4efcdfe7e769","versionType":"git"},{"version":"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f","status":"affected","lessThan":"06a9460b8b792e109cbc934a856d02e5cff217ef","versionType":"git"},{"version":"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f","status":"affected","lessThan":"11cef99491117d4264603df159c4ff5f3845a059","versionType":"git"},{"version":"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f","status":"affected","lessThan":"8662e56c31cf23b61ca3d11b516efb94c35b8026","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/industrialio-buffer.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.11","versionType":"semver"},{"version":"6.12.110","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.51","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.5","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/industrialio-buffer.c"]}],"references":["https://git.kernel.org/stable/c/311595dc0b5621f74d8eb4dc38ef4efcdfe7e769","https://git.kernel.org/stable/c/06a9460b8b792e109cbc934a856d02e5cff217ef","https://git.kernel.org/stable/c/11cef99491117d4264603df159c4ff5f3845a059","https://git.kernel.org/stable/c/8662e56c31cf23b61ca3d11b516efb94c35b8026"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89941.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89941","state":"PUBLISHED","datePublished":"2026-09-16T10:32:29.148Z","dateUpdated":"2026-10-19T08:55:15.605Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.777Z"},"containers":{"cna":{"title":"iio: buffer: Make IIO DMA fence release RCU-safe","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: buffer: Make IIO DMA fence release RCU-safe\n\nThe `dma_fence` documentation states that if a custom release\nimplementation is provided, the `dma_fence` object must be freed in an\nRCU-safe way. The current `iio_dma_fence` implementation uses `kfree()`,\nwhich might result in a use-after-free.\n\nRemove the custom `release` implementation. This makes the DMA fence core\nfall back to `dma_fence_free()`, which calls `kfree_rcu()` on the fence.\nThis requires that the fence be the first member of `struct iio_dma_fence`.\n\nUsing the default release method for extended DMA fence structures is a\ncommon pattern."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f","status":"affected","lessThan":"311595dc0b5621f74d8eb4dc38ef4efcdfe7e769","versionType":"git"},{"version":"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f","status":"affected","lessThan":"06a9460b8b792e109cbc934a856d02e5cff217ef","versionType":"git"},{"version":"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f","status":"affected","lessThan":"11cef99491117d4264603df159c4ff5f3845a059","versionType":"git"},{"version":"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f","status":"affected","lessThan":"8662e56c31cf23b61ca3d11b516efb94c35b8026","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/industrialio-buffer.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.11","versionType":"semver"},{"version":"6.12.110","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.51","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.5","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/industrialio-buffer.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/311595dc0b5621f74d8eb4dc38ef4efcdfe7e769"},{"url":"https://git.kernel.org/stable/c/06a9460b8b792e109cbc934a856d02e5cff217ef"},{"url":"https://git.kernel.org/stable/c/11cef99491117d4264603df159c4ff5f3845a059"},{"url":"https://git.kernel.org/stable/c/8662e56c31cf23b61ca3d11b516efb94c35b8026"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The use-after-free is reached only through local IIO character-device ioctls (IIO_BUFFER_GET_FD_IOCTL then IIO_BUFFER_DMABUF_ATTACH/ENQUEUE_IOCTL on /dev/iio:deviceN); there is no network, Bluetooth, or USB packet path into the IIO DMA fence release.\nAC:L - The attacker controls both sides of the race by enqueueing IIO DMA-BUF transfers that create and later kfree() the fence while concurrently waiting on or exporting the same dma-buf's reservation fences via DMA_BUF_IOCTL_SYNC/EXPORT_SYNC_FILE, so the missing RCU grace period is attacker-driven.\nPR:L - The IIO open and ioctl path performs no capability check; only filesystem access to /dev/iio:deviceN is required. On Android, automotive, and industrial/SDR systems that ship DMA-capable IIO converters, that node is commonly group-accessible to unprivileged sensor or application users.\nUI:N - The attacker opens the IIO device, attaches their own DMA-BUF, and issues enqueue and dma-buf sync/export ioctls themselves; no separate victim action is required.\nS:U - The freed iio_dma_fence lives in the host kernel heap and any resulting corruption stays within the same kernel security authority; this is not a VM escape or IOMMU/DMA boundary bypass.\nC:H - Immediate kfree() of the dma_fence lets concurrent dma_resv RCU walkers (dma_fence_get_rcu, dma_fence_driver_name) read the reclaimed slab object; per kernel scoring guidance a use-after-free is High confidentiality impact.\nI:H - The freed dma_fence contains ops function pointers, callback lists, and a spinlock used after free; reclaiming the object with attacker-controlled data yields write and control-flow hijack primitives, so integrity impact is High.\nA:H - Use-after-free of the fence from dma_fence_release or dma_resv iteration causes a kernel oops or panic even without a full exploit, so availability impact is High."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-19T08:55:15.605Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.12.110"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.18.51"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.2.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}