{"id":"CVE-2026-89940","revision":"4c376ecb16b84f27a6b2d688f2ca54de","records":[{"revision":"4c376ecb16b84f27a6b2d688f2ca54de","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89940","aliases":[],"title":"iio: buffer: Tie IIO dma fence lock lifetime to the fence","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: buffer: Tie IIO dma fence lock lifetime to the fence\n\nThe `iio_dma_fence` implementation currently uses a lock embedded in the\n`iio_dmabuf_priv`. But the `iio_dma_fence` can outlive the\n`iio_dmabuf_priv`, which can cause a use-after-free.\n\nTie the lifetime of the lock to the lifetime of the fence by embedding them\nin the same struct.\n\nWe can't just hold a reference to the `iio_dmabuf_priv` from the\n`iio_dma_fence` since `iio_buffer_dmabuf_release()` might sleep and the\nfence release callback is not allowed to sleep.\n\nNote that the `dma_fence` framework now has an internal lock that gets used\nwhen the passing `NULL` for `lock` in `dma_fence_init()`, but in order to\nallow this patch to be backportable use an external lock.","state":0,"publishedAt":"2026-09-16T10:32:28.395+00:00","modifiedAt":"2026-10-19T08:55:14.651+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/iio/industrialio-buffer.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f\",\n                            \"lessThan\": \"6865d79fca17a80fbd60c12550ca9a5e0e20e0eb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f\",\n                            \"lessThan\": \"510497e31be4f241103507315a859e2085ccb081\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f\",\n                            \"lessThan\": \"8b3e221590181a8beb3735bbabf166df02c839b5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f\",\n                            \"lessThan\": \"f25ec4627d935dedfb5fe83bd2c2678cdcc19611\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/iio/industrialio-buffer.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.11\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.51\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/6865d79fca17a80fbd60c12550ca9a5e0e20e0eb","https://git.kernel.org/stable/c/510497e31be4f241103507315a859e2085ccb081","https://git.kernel.org/stable/c/8b3e221590181a8beb3735bbabf166df02c839b5","https://git.kernel.org/stable/c/f25ec4627d935dedfb5fe83bd2c2678cdcc19611"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89940","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89940","identifiers":["CVE-2026-89940"]},"retained":false,"historicalAffected":[]}],"coverage":[]}