CVE-2026-89941: iio: buffer: Make IIO DMA fence release RCU-safe
In the Linux kernel, the following vulnerability has been resolved:
iio: buffer: Make IIO DMA fence release RCU-safe
The dmafence documentation states that if a custom release implementation is provided, the dmafence object must be freed in an RCU-safe way. The current iiodmafence implementation uses kfree(), which might result in a use-after-free.
Remove the custom release implementation. This makes the DMA fence core fall back to dmafencefree(), which calls kfreercu() on the fence. This requires that the fence be the first member of struct iiodmafence.
Using the default release method for extended DMA fence structures is a common pattern.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Remove the custom release implementation from struct iio_dma_fence and make the dma_fence the first member so the DMA fence core uses dma_fence_free(), which calls kfree_rcu().
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel IIO buffer code with the affected custom iIO DMA fence release implementation are exposed. The issue concerns lifetime handling of iio_dma_fence objects.
What condition can trigger the vulnerability?
The problem can occur when an iio_dma_fence is released while RCU-based access to the DMA fence may still be possible. The custom release path used kfree() rather than an RCU-safe free operation, creating a potential use-after-free.
What is the remediation?
Apply the available kernel fixes referenced in the advisory. The fix removes the custom release implementation so the DMA fence core uses dma_fence_free(), which frees the fence through kfree_rcu().
Is there a documented workaround if the fix cannot be applied immediately?
No workaround is provided in the available data. The documented remediation is to use the corrected release behavior that relies on the DMA fence core's RCU-safe freeing path.