{"id":"CVE-2026-89941","revision":"442aa2039cb1465d8afd975ee29d540e","records":[{"revision":"442aa2039cb1465d8afd975ee29d540e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89941","aliases":[],"title":"iio: buffer: Make IIO DMA fence release RCU-safe","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: buffer: Make IIO DMA fence release RCU-safe\n\nThe `dma_fence` documentation states that if a custom release\nimplementation is provided, the `dma_fence` object must be freed in an\nRCU-safe way. The current `iio_dma_fence` implementation uses `kfree()`,\nwhich might result in a use-after-free.\n\nRemove the custom `release` implementation. This makes the DMA fence core\nfall back to `dma_fence_free()`, which calls `kfree_rcu()` on the fence.\nThis requires that the fence be the first member of `struct iio_dma_fence`.\n\nUsing the default release method for extended DMA fence structures is a\ncommon pattern.","state":0,"publishedAt":"2026-09-16T10:32:29.148+00:00","modifiedAt":"2026-10-19T08:55:15.605+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/iio/industrialio-buffer.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f\",\n                            \"lessThan\": \"311595dc0b5621f74d8eb4dc38ef4efcdfe7e769\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f\",\n                            \"lessThan\": \"06a9460b8b792e109cbc934a856d02e5cff217ef\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f\",\n                            \"lessThan\": \"11cef99491117d4264603df159c4ff5f3845a059\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f\",\n                            \"lessThan\": \"8662e56c31cf23b61ca3d11b516efb94c35b8026\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/iio/industrialio-buffer.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.11\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.51\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/311595dc0b5621f74d8eb4dc38ef4efcdfe7e769","https://git.kernel.org/stable/c/06a9460b8b792e109cbc934a856d02e5cff217ef","https://git.kernel.org/stable/c/11cef99491117d4264603df159c4ff5f3845a059","https://git.kernel.org/stable/c/8662e56c31cf23b61ca3d11b516efb94c35b8026"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89941","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89941","identifiers":["CVE-2026-89941"]},"retained":false,"historicalAffected":[]}],"coverage":[]}