CVE-2026-63930: iio: buffer: hw-consumer: fix use-after-free in error path
Published Jul 19, 2026
·
Updated
In the Linux kernel, the following vulnerability has been resolved:
iio: buffer: hw-consumer: fix use-after-free in error path
In the errputbuffers cleanup path of iiohwconsumeralloc(), the code
was using listforeachentry() to iterate through buffers while calling
iiobufferput() which can free the current buffer if refcount drops to 0.
The listforeachentry() loop macro then evaluates buf->head.next to
continue iteration, accessing the freed buffer.
SecAlerts Pty Ltd. 132 Wickham Terrace Fortitude Valley, QLD 4006, Australia info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
The vulnerable path is the err_put_buffers cleanup path in iio_hw_consumer_alloc(). It is reached when buffer allocation or setup encounters an error and cleanup releases buffers whose reference count can drop to zero.
2
What level of access does an attacker need?
The supplied severity vector identifies this as locally exploitable with low privileges and no user interaction. The data does not describe a remote attack path.
3
What should administrators do if their kernel may be affected?
Apply the available kernel patch. The fix changes the cleanup-loop iteration to a safe list traversal so that releasing a buffer cannot cause the next iteration to access freed memory.